Position: Application Security Engineer
Company: Shopmonkey
Category: Security
Experience required: 3y
English level: intermediate

**Who we are**
Shopmonkey, the leading auto-repair shop software company, is a cloud-based solution that consolidates the complexities of running an auto repair business — from appointment scheduling, to parts ordering, to managing inventory and processing payments — all onto a single platform. We help repair shops consolidate tools, save time, and streamline their entire operation with simple, easy-to-use software.
 
**Industry you will impact**
The US is the second largest passenger vehicle market with more than 260 million registered passenger vehicles, and the global car repair market is estimated to be worth more than $500B. Shopmonkey aims to change the status quo and enable auto shops to become more efficient and give their customers a more delightful experience.

**About the role**
**Business Case**
As Shopmonkey continues targeting enterprise deals, the maturity of our security practices need to align with enterprise requirements. Companies such as Mr. Lube expect us to follow security best practices such as performing penetration testing and scanning our code for vulnerabilities.

As we continue to deploy more features and more products, our application security program must also grow. Having a dedicated team (or at least an individual to start the program) is vital to ensure our application does not expose our customers to undue risk.

This role will take on such challenges as automating static code analysis to identify vulnerabilities during the code development process, as well as dynamic code testing to identify vulnerabilities identified during QA. 

They will also ensure that vulnerabilities reported by security researchers are mitigated, and that we encourage these individuals to continue researching and reporting any findings to us. They will also help to coordinate 3rd party penetration tests, and translate identified vulnerabilities into actionable resolutions.

By having this role separate from Engineering (although they would work closely with Eng and Product Mgmt), we ensure objectivity and focus exclusively on application security. Throwing bodies at fixing security bugs after deployment will never scale, and may introduce an
unacceptable level of risk. Instead, the Application Security Engineer will deploy scalable security education, tools, and processes that prevent vulnerabilities from ever being deployed in the first place.

**You will have the opportunity to:**
● Serve as the subject matter expert for application security and provide guidance to the Engineering and Product Management teams.
● Ensure security of the product is prioritized while supporting the business, operational, and usability requirements.
● Build, deploy, operate, and automate solutions for static and dynamic application security testing.
● Manage the responsible disclosure program and track security vulnerabilities through remediation.
● Coordinate external penetration tests and other offensive testing as needed.
● Participate in security incident response efforts.

**We’re looking for you if you have:**
● At least Intermediate proficiency in speaking and writing English.
● Deep understanding of web application security threats, exploits, and prevention.
● Practical knowledge of OWASP Top 10.
● Experience in the deployment and management of SAST/DAST tools and technologies.
● Ability to triage, reproduce, recommend remediation, and implement fixes for vulnerabilities.
● Familiarity with modern software development methodologies, processes, and tools.
● Ability to work in a self-directed environment that is highly collaborative and cross-functional.
● Background in web app development, sys admin, and/or code auditing preferred.

**Why Shopmonkey**
● With technology as your main problem solving skill you will **bring value** to the customers and feel the impact you make as an engineer. Seeing the results fuels us to keep innovating.
 
● Ever-growing product that leads the industry and cutting-edge tech solutions with **freedom in experiments** will affect your rapid growth as a professional.
 
● **Transparency and equality** no matter what title you have. We're growing but we aren’t losing our startup spirit. Work in a supportive responsive atmosphere of hungry, humble, smart people who're united with one focus - quality product.

● We’re empowering our team to do their best work. **Great salary package, Employee stock options**, flexible scheduling & paid vacation and sick leave period. We promote being family-focused, and respect your desire to work from home when required.
 
● Nowadays health is a priority. We’ll make sure you have what you need to lead a healthy life - **VIP medical insurance**, wellness benefits, access to mental health vetted programs and resources.
 
● Your professional growth and opportunities for education matters. That’s why we set up a yearly **education budget** for conferences, professional events, courses, reimburse English classes and create coaching & mentor programs.

● Engineering Department in Kyiv, UA, and Headquarter in San Jose, CA, US.


 __//___________//_____________//____________//__________//_________
Shopmonkey is committed to building a diverse and inclusive team. We are looking for team members that are committed to the Shopmonkey mission. All applicants will be considered for employment regardless of race, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.