Position: Application Security Expert  Middle/Senior
Company: Сapgemini
Experience required: 2y
Category: DevOps
English level: intermediate
Published: 2023-04-01T00:00:00+03:00

●   Penetration Testing – Perform dynamic analysis of web and mobile applications to identify security vulnerabilities and weaknesses; create Penetration Test Reports documenting findings; input findings to JIRA for remediation; consult with product team personnel to provide remediation advice. We use burp based tooling for the most part. DataTherem is our main mobile tool. 
●   Threat Modeling – Conduct structured analysis of application attack surface and threats using the client's tool, which is based on process OR industry standard practices (STRIDE) as directed. Document findings in Threat Model Assessment Report and consult with product team personnel on strategies to mitigate identified risks in current or to be developed software
●   Cloud roles: AWS and GCP Security & Architecture Reviews – Assess Amazon Web Services (AWS) and GCP implementations for potential security vulnerabilities; review AWS and GCP design and configurations to ensure best practices are utilized to minimize or eliminate risk in an efficient and sustainable manner; document findings and recommendations; consult with stakeholders as needed
●   Security automation - Deploy tools for security automation in the Cloud.
●   Document process for various product security activities – Create and update process documentation on an as-needed basis
●   Code Review – Perform static analysis of application source code to identify security vulnerabilities and weaknesses; create Code Review Report documenting findings; input findings to JIRA for remediation; consult with product team personnel to provide remediation advice. Expect a mix of manual, Checkmarx, and semgrep based analysis.
●   Software Design and Architecture Review – Analyze existing applications, proposed changes, and new software development designs and architecture to ensure security best practices are incorporated to meet our client's security requirements; document findings in Architecture Assessment Reports; consult with product team personnel and software architects  
●   Supporting our client's full time staff during vacations and periods of peak project load – Filling in and/or augmenting staff during vacations, staff turnover, and periods of peak project activity to ensure application security initiatives proceed on schedule and product teams have necessary support

●   At least 5 years in the field
●   Penetration Testing
●   Threat Modeling
●   Experience with AWS and GCP Cloud
●   Experience in designing new software and analyze existing applications