Position: Application Security Engineer (Penetration Testing, Threat Modeling, AWS/GCP)
Company: Capgemini Engineering Ukraine
Category: Security
Experience required: 3y
English level: intermediate
Published: 2023-04-01T00:00:00+03:00

We are seeking an experienced Application Security Engineer to join our team. As an SME, you will work independently to perform various responsibilities and tasks in support of our client's Application Security Program.

**Responsibilities:**
•	Perform dynamic analysis of web and mobile applications to identify security vulnerabilities and weaknesses using burp-based tooling for the most part, and DataTherem as our main mobile tool
•	Conduct structured analysis of application attack surface and threats using the client's tool, which is based on process OR industry standard practices (STRIDE) as directed. Document findings in Threat Model Assessment Report and consult with product team personnel on strategies to mitigate identified risks in current or to be developed software
•	Assess Amazon Web Services (AWS) and GCP implementations for potential security vulnerabilities; review AWS and GCP design and configurations to ensure best practices are utilized to minimize or eliminate risk in an efficient and sustainable manner; document findings and recommendations; consult with stakeholders as needed
•	Deploy tools for security automation in the Cloud
•	Create and update process documentation on an as-needed basis
•	Perform static analysis of application source code to identify security vulnerabilities and weaknesses using a mix of manual, Checkmarx, and semgrep-based analysis. Create Code Review Report documenting findings; input findings to JIRA for remediation; consult with product team personnel to provide remediation advice
•	Analyze existing applications, proposed changes, and new software development designs and architecture to ensure security best practices are incorporated to meet our client's security requirements. Document findings in Architecture Assessment Reports; consult with product team personnel and software architects
•	Fill in and/or augment staff during vacations, staff turnover, and periods of peak project activity to ensure application security initiatives proceed on schedule and product teams have necessary support

**Requirements:**
•	At least 3 years in the field as an Application Security Engineer
•	Experience with Penetration Testing, Threat Modeling, and Cloud Security (AWS and GCP)
•	Experience in designing new software and analyzing existing applications