Position: Application Security Engineer / Pentester
Company: IT SmartFlex
Experience required: 3y
English level: intermediate

We’re looking for someone who has:

• Software development experience in a production environment
• A deep understanding of the application architecture
• A knack for finding flaws in software and can efficiently communicate how to fix them
• Strong communication skills and is accustomed to working closely with a product team
• Doesn’t always default to industry norms when solving a problem
• An ability to think like an attacker to develop threat models
• Has designed and implemented mitigations for common classes of bugs
• Intermediate level of English or higher

**Preferred qualification:**

3 or more years’ experience in:
• Authentication (Identity management, MFA/2FA)
• Applied Cryptography (PKI, Appropriate usage of Cryptographic Primitives, Digital Signatures, HASHing, HMACs) 
• Authorization (claims, RBAC, fine grained, coarse grained, XACML, OAUTH, SAML)
• Web Services Security (WS-Security, Oauth, JWT)
• Static Source Code Review Tools (e.g. Fortify, Appscan Source, Contrast, etc).
• Application Service Hardening (CIS, NSA/DOD STIGs)
• Coding experience in one or more general languages
• Mobile App development experience a plus

**Nice to have:**

• 3 years of relevant work experience
• Hard Core Development Skills
• Detail-Oriented

**Responsibilities:**

• Work with our code
• Develop techniques to ensure development teams find flaws before they are introduced into production
• Be a security subject matter expert and respond to any security development question
• Work with development teams to design solutions that are inherently secure
• Be a champion for simple security models
• Correctly balance security risk and product advancement
• Lead software security initiatives
• Lead or participate in threat modeling discussions
• Perform code deep dives to uncover security vulnerabilities or design
• Document findings and architectural issues for development and other security teams consumption
• Evaluate the security posture of existing applications
• Perform proactive research to detect new attack vectors and pentest internal and external apps

**What we offer:**

• Work in a friendly creative environment using modern technologies
• Work-life balance and flexible work schedule
• Corporate trainings, professional conferences, specialized courses
• Knowledge sharing and best practices, communities of interest
• Competitive salary level
• Medical insurance from the first month of work
• 24 days of paid vacation
• Paid sick leaves