Position: Security Engineer
Company: Nixwood
Experience required: 5y
English level: upper

We are looking for a Security Engineer to join our clients team on a subcontract basis.

Tech Stack:

Monolith, Ruby on Rails 6, Ruby 3.1.4
Vue 2.6.14 as of now, and the entire frontend is written in ES6-compatible JavaScript
Moving towards Vue.js 3

Must have:

Security code reviews for at least one of these programming languages: Python, Java, Go, C#, JavaScript, C/C++, PHP
It would be sufficient to have at least 3-6 months of work in one of the languages
Ability to identify vulnerabilities and vulnerability classes that are specific to programming languages
Understand what sources, sinks, and sanitizers are in the context of SAST
Understanding of CVE, CWE, CVSS and how they apply to vulnerabilities
How to mentally trace data and control flow when analyzing an application for vulnerabilities
Experience using SAST tools
Software engineering experience (outside of security)
Self-motivated and self-managing, with excellent organizational skills and eyes for quality
English - Upper-Intermediate

Обов'язки:

Assist in enhancing customers Semgrep rules to detect vulnerabilities and minimize false positive matches
Create new Semgrep rules for identifying web framework-specific vulnerabilities
Create tests both positive and negative when creating or modifying Semgrep rules
Write clear and formal descriptions of vulnerabilities and how to remediate them

Ми пропонуємо:

Повний робочий день на віддаленій основі
Початок - якнайшвидше
Тривалість - 3+ місяці