Position: Application Security Engineer
Company: pdfFiller
Category: Security
Experience required: 3y

**A Few Words About Us:**

airSlate is a global IT company founded in Boston, USA, back in 2008. Today, the Company develops products aimed at business process automation and digital workflow management. airSlate brand portfolio consists of four services:
— airSlate — no-code automation for business processes;
— pdfFiller — online PDF editor;
— SignNow — eSignature tool;
— USLegal — the US largest online library of legal forms and templates.

Over 40 mln people are currently using the Company’s services. Of those, 500k are regular business customers. Over 900 employees are working in the offices located in the US, Ukraine, Russia, and the Philippines. The Head office is in Boston, MA.

**Why Us:**

**First of all, it’s our products.**

These are fast-growing, socially beneficial applications that are used by tens of millions of customers around the world.

**Second, it’s our company culture.**

We are looking for open-minded people who never stop in their self-development, who never refuse to help and are willing to suggest new ideas for our products and workflow development.

**Third, it’s our benefits.**

— The members of our team get monthly bonuses and options contracts (each of us has a share so that Company’s growth translates into capitalization of one’s interest);
— We’ve organized PHP, JS, QA Automation and DevOps schools where the trainers are our employees. Anyone may try their hand at one of the schools and attend the course;
— We have a personal training budget for all of our employees. This budget can be used for career courses and conferences that can help with professional growth;
— Language classes;
— Regular sports activities with professional coaches: yoga, stretching (3 times a week) and TRX;
— Medical insurance;
— In-house massage therapist;
— All financial information about the company’s growth is open to every employee of airSlate. Every 2 weeks we all receive a full financial report directly from the Company’s CEO during the Q&A meeting.

**What We Expect From You:**

— 3+ years of experience testing applications (web, mobile);
— Experience with penetration testing, threat modeling, open-source, and commercial security tools;
— Experience with CI/CD;
— Strong familiarity with application security concepts/standards/laws/best-practices (e.g., OWASP, CIS, NIST SP 800, ISO27000 series);
— Scripting experience (python/go) for the purposes to automate/script daily tasks / Some experience in a scripting/coding language, such as Java, JS, Python, Shell, etc.;
— Understanding the OWASP Software Assurance Maturity Model (OSAMM).

**As a plus:**

— Relevant security, systems, networking certifications;
— Participation in the bug bounty hunting community;
— Hashicorp Technologies (Terraform, Vault).

**Responsibilities:**

— Web, mobile, network security testing;
— Providing guidance on the secure software development at all stages of SDLC, including architecture and design reviews prior to the start of development;
— Design, build, and review security-related services and functionality of web applications, mobile applications, and desktop applications;
— Evaluate and maintain IAST, SAST, DAST and other similar tools for automated scanning;
— Assist other members of the security team during testing and purple team exercises;
— Working with security champions;
— Integrate security controls in CI/CD and operational pipelines.