Position: Expert Cyber Security Engineer
Company: Ciklum
Category: Security
Experience required: 3y
English level: intermediate

Responsibilities:
•	Act as a Subject Matter Expert (SME) in application security (one of or several: Web, Mobile, IoT) and Cloud Security (AWS)
•	Performing security assessment and penetration testing
•	Doing vulnerability identification and validation using automated and manual ways
•	Facilitate vulnerability remediation by capturing, arranging, communicating information about vulnerabilities and mitigation steps. Help key stakeholders to understand the vulnerabilities
•	Working closely with key stakeholders on software development projects (Developers, Architects, Product Owners) promoting and implementing leading security mechanisms in the software products and infrastructure
•	Contribute to increasing alignment between software development projects’ stakeholders through proper definition and updating cyber security standards and guidelines
•	Provide comprehensive guidance on secure system architecture and software development processes aiming to achieve security of solutions
•	Providing technical training on the application security
•	Toolset and scripts development for the security projects, including tools for application security assessment and infrastructure security implementation, including Infrastructure-as-a-Code scripts
•	Estimation of application security risks and suggesting mitigation strategies
•	Clear describe advices on risk reduction by outlining security findings, potential impacts and advising on mitigation approach

Requirements:
•	BS in Computer Science or related field
•	4  years of relevant work experience including but not limited to: AWS Security, Web and Mobile Application Security, Penetration testing, Vulnerability assessment, and Code-level Security Auditing
•	Deep experience in secure coding practices in AWS environment
•	Knowledge of Cloud Infrastructure components. Experience with AWS cloud infrastructure
•	Ability to manually find and exploit basic web vulnerabilities
•	Experience with various penetration testing tools (e.g. BurpSuite, Metasploit, OWASP ZAP) on Linux and Windows
•	Experience with one or more scripting languages: Python, Ruby, PHP, Bash, and Perl.
•	Knowledge and understanding of Application Security, System and Network Security, Authentication and Security protocols
•	Familiarity with OWASP Testing Guide, OWASP Top 10
•	Upper Intermediate English level (CEFR level B2)

Desirable: 
•	Deep experience in designing secure, highly available, distributed applications
•	Understanding of mobile device and application security
•	Security related certifications:
o	ISC2: CISSP
o	EC-Council: CEH
o	Offensive Security: OSCP, OSWE, OSCE
o	eLearnSecurity: eMAPT, eWPTx
o	ISACA: CISA, CISM
•	Experience with Bug Bounty programs (e.g. BugCrowd, HackerOne)
•	Security related publications, blog posts, and/or participation in tools development
•	Fluent English (CEFR level C1)
•	Experience with information security standards & practices and their practical implications
•	Deep automation skills, hands-on with some programming languages
•	Good experience with CI/CD, preferably Gitlab CI
•	Ability to design, build, test, and deploy applications on AWS
•	Understanding of social and ethical implications of software engineering

Personal skills: 
•	Customer centric
•	Committing to deliver great digital products and services
•	Passionate about continuous improvement, collaboration and growing great teams
•	Compelling coaching and training skills
•	Strong problem-solving skills coupled with good communication skills
•	Open minded, inquisitive, life-long learner
•	Comfortable with ambiguity, highly autonomous
•	Demonstrating true software craftsmanship mindset
•	Ability to share professional software engineering skills

What’s in it for you? 
•	A Centre of Excellence is ultimately a community that allows you to improve yourself and have connections with bright people. Our centres of excellence (CoE) bring together all Ciklumers from across the organisation to share best practices, support, advice, industry knowledge.