Position: Application Security Analyst
Company: Omilia Natural Language Solutions Ltd
Experience required: 2y
Category: Security
English level: upper
Published: 2022-08-01T00:00:00+03:00

DESCRIPTION

 The Application Security Analyst helps improve and maintain the Omilia application security program and overall company and product / services security posture, by serving and providing experienced guidance pertaining to technical vulnerability management principles including aspects of secure software development, design, and testing. The resource will partner with
 Product and Delivery teams to educate, evangelize, and validate secure development and vulnerability management practices.

REQUIREMENTS

- Key Accountabilities
- Exercise product assessments as part of Secure Software Development Lifecycle (SDLC):
- Improve the program's effect of modern application security concepts in an Agile methodology on a regular basis;
- Perform security activities, including security design reviews, threat modelling, and code auditing on internally & externally developed software;
- Implement and control the use of automated secure coding tools and techniques (SAST, DAST);
- Perform security code reviews;
- Perform External Penetration Tests:

- Perform Security Assessments against public-facing company and product/services web applications and hosting infrastructure;
- Perform internal and external penetration tests and vulnerability assessments against company and product/services applications and hosting infrastructure;
- Manage 3rd party security assessments for applications and infrastructure;
- Reporting and monitoring mitigation activities:

- Create reports and recommendations from penetration testing, vulnerability assessments, and application іусгкшен assessment findings, including the security issues uncovered and the level of inherent risk;
- Consult with Application Developers, DevOps, Quality Assurance Engineers, and other stakeholders to demonstrate security testing results, explain the threats presented by the results, and consult on remediation;
- Operate as incident responder for triage pertaining to web-based vulnerabilities;
- Monitor and report progress on mitigation activities and propose product optimization in the
context of security.
- Selecting and maintaining the toolset that will be used for above-mentioned activities:
- Govern automated secure coding tools and processes (SAST, DAST, etc);
- Evaluate, test, conduct PoCs and otherwise assist in selecting assessment tools to support the minimalization of company and product / services security posture;
- Propose improvements in the toolset used for application security assessment activities;
- Automate penetration and other security testing on networks, systems, and applications.
- Awareness and trainings

- The Develop application security training documentation;
- Provide application security guidance and training to Product, Delivery, and QA teams for building resilient products;
- Stay current on trends in application security and the latest compliance information
- Contribute actively and effectively as an integrated team member:

- Meet regularly with the line manager to review progress;
- Manage issue resolution and critically escalate;
- Work effectively with other teams, units, and departments;
- Manage issues with clarity and ensure effective information flow and team working;
- Support other organization’s priority activities, when necessary;
- Act as an Omilia ambassador.

KNOWLEDGE, SKILLS & EXPERIENCE
MANDATORY:

- Academic degree in degree in technical studies, Computer Science, - - - - Information Security,Mathematics, or related field 2-3 years in Information - - - - Technology, with a background in Application Security;
- Demonstrated experience in automated and manual penetration testing tools and techniques;
- Demonstrated experience with secure software development design principles and secure testing;
- Broad technical background and solid understanding of application security (including OWASP);
- Knowledge of tactics, techniques, and procedures that could be used for recon, persistence, lateral movement, and exfiltration;
- Basic knowledge of the following areas: networking devices, operating systems, applications,
and APIs;
- Understanding of programming languages such as Java, JavaScript, React, - - NodeJS and Python;
- Network and web-related protocol understanding;
- Work independently and prioritize multiple tasks and adapt to needed changes;
- Ability to work under strict deadlines and remain calm under high pressure/difficult situations;
- Strong skills in written and verbal communication in English.

NICE TO HAVE:

- Master’s degree in Computer Science or Information Security;
- Prior experience with DAST, SAST, IAST tools;
- Prior experience with SIP penetration testing;
- Expert knowledge of at least one programming language (Python, Bash, Go, Java, PowerShell, etc.);
- Experience in container and Kubernetes testing and working knowledge of security best practices;
- Industry certifications such as CEH, eJPT, eCPPT, eWPT, OSCP, OSCE;
- Excellent understanding of AI & IT industry.

BENEFITS

- Fixed compensation;
- Long-term employment with 24 working days vacation;
- Development in professional growth (courses, training, etc);
- Being part of successful cutting-edge technology products that are making a global impact in the service industry;
- Proficient and fun-to-work-with colleagues;
- Apple gear.