Position: Application Security Engineer (located in Romania)
Company: Sectigo
Category: Security
Experience required: 5y
English level: upper

The Application Security Engineer will become the primary security expert for multiple product lines by working with development teams to improve security by reviewing application architecture and incorporating security into the software development lifecycle. 

**Responsibilities:**

• Lead, design and develop in-depth security architecture and engineering of security controls to validate that Sectigo’s products, services, applications, and emerging technologies are designed and implemented to the highest security standards. 

• Enable developers and product teams to deliver secure-by-design applications and infrastructure, by providing cybersecurity expertise and guidance throughout the system development lifecycle. 

• Design and develop coding standards across infrastructure, application, and data security, building out guidelines and standards to drive a standardized set of security requirements that align with internal policies and meet external compliance/regulatory requirements. 

• Partner with application development teams to identify security requirements for products, develop security architecture, develop detailed design, and provide support to help integrate security controls during solution deployment. 

• Perform manual application security assessments (penetration tests) and manual source code reviews for applications, websites and products. 

• Perform threat modeling, conduct reviews of security architecture and platform/service designs, and audit source code. 

• Review security test results from vulnerability scans and penetration tests and propose appropriate remediation measures or mitigation controls, conduct a remediation plan and supervise its progress. 

• Assist in incident response by providing engineering support to remediate critical security bugs in production environments. 

• Provide expertise on Static and Dynamic code scanning tool configuration and use, interpreting results and providing expertise on how to resolve vulnerabilities. 

• Provide expertise on the deployment and configuration of web application firewalls including logging of all WAF events and its attachment configuration to Sectigo’s security information and event management system. 

• Investigate and report on common, known vulnerabilities in systems and platforms. 

• Accurately document system deficiencies, recommend solutions and track remediation activities. 

• Maintain current knowledge of security threats and vulnerabilities that could impact products and continuously research and develop integration and deployment tools, including security testing techniques, process and automation to support and improve application security assessments. 

• Working with the development teams to improve the security of CI/CD processes by ensuring version control for source code, scanning code for vulnerabilities in the build pipeline, and ensuring public/ private repositories are trusted and secure. 


**Qualifications:**	 

• Hold one or more of the following professional certifications: CISSP, CEH, CISM 

• Minimum 7 years of experience with creating security architecture and engineering templates to mitigate application security risks as referenced by sources such as OWASP Top 10 and MITRE ATT&CK 

• Minimum 3 years of experience with at least one modern cloud environment (AWS, Google Compute Cloud and Microsoft Azure) 

• Minimum 3 years of experience with DevSecOps software development methodologies. 

• Experience coding in Java, Python, or Go, and at least one scripting language. 

• Experience working with SQL languages: Postgres, MySQL, etc. 

• Experience working with deployment tools: Ansible, Chef, Puppet, etc. 

• Experience working with Open-Source code. 

• The ability to review multi-tiered, service-oriented application architecture and identify flaws that can be exploited by adversaries that can impact the confidentiality, availability and integrity of products and applications. 

• Hands On ability to perform manual penetration testing of web and/or mobile applications. 

• Experience in implementing and integrating security tools and security practice into CI/CD pipeline from source code, build processes, repositories to deployment. 

• Ability to review application code in Go and JAVA to identify security vulnerabilities in the following areas but not limited to (authentication, entitlements, identity management, data protection, data leakage prevention, validation checking, encryption, secure communication, and secure data storage) 

• Familiarity with application security tools including SAST, SCA, DAST, Penetration testing, etc. 

• In depth ability to secure source code, APIs, containers and open-source software and artifacts.