Position: Application Security Engineer
Company: EPAM
Experience required: 5y
English level: upper

Customer looking for Application Security Engineer with web-dev experience. 

Role: Application Security Engineer 

Position is responsible for on boarding and maintaining vulnerabilities discovered via scanning tools and manual reviews.

GENERAL DUTIES AND RESPONSIBILITIES: 

• Assist in evaluating, planning, configuration, and implementation of new/existing security applications/tools 

• Systematically address application security issues and develop secure coding practices for multiple development teams 

• Integration of application authentication, encryption, authorization, and access control 

• Provide mitigation strategies for applications from a secure coding perspective 

• Utilize application security scanning tools such as Burpsuite/Fortify to interpret reports and validate identified vulnerabilities and associated risks 

• Utilize source code scan tools to assist application development teams to apply the best practice for application security and catch potential vulnerabilities at early stage 

• Proactively work with team members to address security and compliance issues 

• Provide education and assistance to application developers for applying Security Software Development Life Cycle 

• Collaborate with development teams to prioritize and remediate vulnerabilities throughout the application lifecycle 


GENERAL KNOWLEDGE, SKILLS & ABILITIES:

5+ years of web development experience
2+ years of .NET C# web development experience on Azure
1+ year of application security experience nice to have
Experience or familiarity with CI/CD pipelines and Agile environments
Static and/or Dynamic Application Security Testing experience desired
BSIMM, OWASP SAMM and/or OWASP ASVS experience nice to have
Experience or familiarity with CI/CD pipelines and Agile environments nice to have
Knowledge of the OWASP Top 10 Risks & Controls, and the SANS Top 25 Software Errors
Knowledge of applications hosted in cloud Amazon Web Services (AWS), Google (GCP) or Microsoft Azure clouds.


-----

Ability to demonstrate effective application vulnerability and penetration-testing skills including Injection, XSS, and XXE attacks in web applications nice to have
Ability to demonstrate effective skill with dynamic and static analysis tools nice to have
Ability to demonstrate effective skill in software engineering principles, frameworks and technologies
Ability to advise other engineers on application security best practices