Position: Application Security Expert
Category: C++
English level: upper
Years of experience: 8

Lead process of SAST in company, controlling integration part with other Enterprise services and providing best usage approach (based on existing limitations).
Analyse market in order to find other solutions with better technical (or nearly the same) capabilities but with low price (or covered price). Participate in testing such solutions and driving such initiatives.
Proposal new controls in order to improve appsec posture in company.
Provide appsec requirements for other teams.

As a final University project wrote module for Apache web-server, for recognition attacks from internet and collection them as a classical honeypot would do.
• Analysing various application security testing solutions (in SAST, DAST, SCA) in terms of quality, coverage, functional features, requirements etc.;
• Communicate with various vendors\distributors (products pilots, licensing models, prices, technical issues etc.);
• Presenting for CISO and other stakeholders suggested visions in application security controls and their workflows (taking in account current company’s posture in CI\CD, DevOps);
• Developing and staging application security initiatives in prescribed documents stack (including projects justifications, application security policies and other documents describing requirements);
• Evaluating SAST, DAST and SCA scans, communicating with developers teams;
• Manual application security testing of outcomes from infrastructure vulnerabilities scans, plus manual exploring of other issue possibilities.

OSS\SCA - BlackDuck, X-Ray.
SAST - Checkmarx, Fortify.
DAST - AppScan.
1) Participate in Application security testing controls;
2) Organising and lead work for appsec team;
3) Working with devops in order to create operational DevSecOps environment;
4) Participate in application security design and threat modelling on early stage of app design.