Job Description

QAD is seeking an Application Security Engineer. As an Application Security Engineer, you will contribute to ensuring the security and integrity of our organization's applications and software systems. You will assist in identifying security vulnerabilities, conducting risk assessments, and implementing security measures to protect our applications from potential threats. This role requires familiarity with application security best practices and the ability to collaborate effectively with development teams.

What you’ll do:

• Assist in conducting security assessments and penetration testing of applications.
• Support development teams in code review and analysis for security vulnerabilities.
• Collaborate on integrating security measures into application design.
• Participate in evaluating and recommending security controls for applications.
• Assist in developing and updating threat models, and contribute to mitigation strategies.
• Educate development teams on secure coding practices and stay informed about security threats.
• Support incident response team in investigating and mitigating security incidents.
• Contribute to maintaining documentation on security policies and procedures.
• Assist in generating reports on security assessments and recommendations.
• Work with cross-functional teams to integrate security into the software development lifecycle.
• Collaborate with external security organizations to stay updated on threats and vulnerabilities.
• Maintain automated processes for SCA, DAST, and SAST.

• Integrate security testing tools into CI/CD pipelines for continuous security assessments. (Gitlab, Terraform, AWS Inspector) 

Qualifications

What you'll need:

• A bachelor's degree in a relevant field such as Computer Science, Information Technology, Cybersecurity, or a related discipline.
• 2-3 years of experience in application security with exposure to AWS, GCP, and cloud architectures.
• Strong programming and scripting skills (Java, Python, TypeScript).
• Effective written and verbal communication skills in English.
• Familiarity with common application security vulnerabilities (OWASP Top 10) and remediation techniques.
• Exposure to tools and techniques for vulnerability assessment, penetration testing, and code review, for example: Veracode, Snyk, SonarQube, Burp Suite.
• Knowledge of security standards, frameworks, and compliance requirements (SAML, OIDC, OAuth, Spring Security).
• Good communication and collaboration skills.
• Relevant certifications such as CISSP, CSSLP, or CEH are a plus.

See more jobs at QAD, Inc.

Apply for this job

Job Description

QAD is seeking a Senior Application Security Engineer. As an Application Security Engineer, you will play a critical role in ensuring the security and integrity of our organization's applications and software systems. You will be responsible for identifying and mitigating security vulnerabilities, conducting risk assessments, and implementing robust security measures to safeguard our applications against potential threats. This role requires a deep understanding of application security best practices, emerging threats, and the ability to work collaboratively with development teams to integrate security seamlessly into the software development lifecycle.

What you’ll do:

• Conduct comprehensive security assessments and penetration testing of applications to identify vulnerabilities and risks.
• Collaborate with development teams to review code, offer guidance on secure coding practices, and assist in remediation efforts.
• Work with software architects to integrate security into application design and recommend security controls.
• Develop and maintain threat models for applications, aiding in the creation of mitigation strategies.
• Educate development teams on secure coding practices and stay informed about evolving security threats and best practices.
• Assist in investigating and responding to application-related security incidents, collaborating with the incident response team.
• Create and maintain documentation on application security policies, procedures, and guidelines.
• Generate reports on security assessments and findings.
• Coordinate with cross-functional teams to integrate security into the software development lifecycle.
• Collaborate with external security organizations and researchers to stay updated on emerging threats and vulnerabilities.
• Define secure application architectures for SaaS applications.
• Develop automated processes for SCA, DAST, and SAST.
• Integrate security testing tools into CI/CD pipelines for continuous security assessments.

Qualifications

What you'll need:

• A bachelor's degree in a relevant field such as Computer Science, Information Technology, Cybersecurity, or a related discipline
• 3-5 years of experience in network security with a strong focus on AWS, GCP, and cloud architectures.
• Excellent written and verbal communication skills in English.
• Senior level programming and scripting skills (Java, Python, TypeScript)
• Proven experience in application security, with a strong understanding of secure coding practices.
• In-depth knowledge of common application security vulnerabilities (OWASP Top 10) and the ability to remediate them.
• Experience with tools and techniques for vulnerability assessment, penetration testing, and code review (Veracode, Snyk, SonarQube).
• Familiarity with security standards, frameworks, and compliance requirements (SAML, OIDC, OAuth, Spring Security).
• Excellent communication and collaboration skills.
• Relevant certifications such as CISSP, CSSLP, or CEH are a plus.

See more jobs at QAD, Inc.

Apply for this job

See more jobs at Tenable

Apply for this job

See more jobs at Abarca Health

Apply for this job

See more jobs at Raftelis

Apply for this job

See more jobs at Databricks

Apply for this job

See more jobs at Tenable

Apply for this job

Job Description

We are looking for an Engineer, Network Security to join our growing team. In this role, you will report directly to the Manager, Network Security. This SME role entails safeguarding all networks, including internal, customer-facing, and Telcom networks. You will actively engage in day-to-day security engineering and operations, serving as a technical authority in network security and possessing a deep understanding of security architecture. You will collaborate closely with IT and Network; and also contribute to diverse projects, demonstrating strong interpersonal skills to cultivate inter-organizational relationships. You will have effective management of project activities, including milestones and timelines, is also expected.

The primary functions of the Network Security Team include:

• Design, deploy, configure, and maintain Palo Alto firewalls
• Manage and administer Azure and GCP firewalls
• Conduct regular reviews and audits of firewall configurations
• Design, implement, and maintain DDoS mitigation solutions
• Management of network authentication technologies like RADIUS and TACACS+
• Manage network protection technologies like IDS and Honeypots

This position requires a strong background and understanding of all network and cloud security domains and works in both the Protect and Respond areas of the NIST CSF Framework. You will be required to make strong cyber security decisions while using a business risk analysis approach. Brightspeed is a cloud-first (Azure, GCP, and SaaS) company with a significant data center presence. This model will require you to consider security across a diverse portfolio of assets and networks. Brightspeed is also in a Zero Trust journey, which means the individual should be able to execute a multi-year program while ensuring network security and moving along the maturity curve. 

As an Engineer, Network Security, your duties and responsibilities will include:

• Design, implement, and lead the comprehensive enterprise cybersecurity network protection programs, leveraging advanced expertise in Palo Alto firewalls
• Conduct thorough reviews and design meticulous firewall rules to ensure strict adherence to corporate security policies
• Design, review, and execute robust network security solutions aimed at safeguarding the integrity of Brightspeed networks
• Serve as the SME of the Network Security team, accountable for ensuring the overall security posture of Brightspeed networks. This includes spearheading device hardening initiatives, monitoring baseline configurations, meeting compliance standards, implementing security best practices, and overseeing remediation efforts.
• Assume ownership of all network protection applications and platforms, overseeing their management, upgrades, configurations, changes, and support
• Collaborate closely with the SOC and incident response teams to effectively resolve network security incidents
• Document, implement, and maintain all network security devices to uphold robust security standards while developing and implementing appropriate strategies for information security policies, standards, and procedures
• Engage proactively in organizational projects as needed, offering valuable insights and specialized expertise in network security domains
• Demonstrate exceptional interpersonal skills, including strong verbal and written communication abilities, enabling effective collaboration with diverse stakeholders
• Oversee the management of the enterprise's Network Security Systems, encompassing Firewalls (including cloud firewalls), DDOS mitigations, RADIUS, and TACACS+ authentication support
  Participate in an on-call rotation to ensure 24/7 coverage of network security operations
• Stay current on emerging cybersecurity threat landscape, vulnerabilities, and trends, and recommend proactive measures to enhance our security posture
• Foster a culture of mentorship by guiding Network Security Analysts and actively participating in knowledge-sharing initiatives

Qualifications

WHAT IT TAKES TO CATCH OUR EYE:

• Bachelor’s degree in Computer Science, Engineering, Cyber Security, or related field
• Demonstrated expertise with firewall management and architecture spanning over 5+ years, with expertise in Palo Alto firewalls
• Extensive background encompassing over 5+ years of hands-on experience in the Network Security field with versatility across various domains of network security
• Proficiency in network security hardening methodologies
• Experience in securing Office 365, Azure AD, and Email is essential
• Proficiency with TACACS+, RADIUS, and DDOS mitigations
• Ability to thrive in a fast-paced environment with multiple competing priorities
• Meticulous attention to detail to ensure adherence to policies and standard procedures
• Proven expertise in implementing security measures within GCP and Azure environments
• Exceptional verbal and written communication skills
• Proficient in TCP/IP routing and switching, as well as network design best practices
• Experience in mitigating DDoS attacks, coupled with proficiency in DDoS attack defense, countermeasures, and packet analysis
• Moderate understanding of BGP, OSPF, Switching topologies, and Cloud networking
• Familiarity with zero-trust architectures is advantageous
• Knowledge of incident response procedures is advantageous
• Scripting experience is beneficial

BONUS POINTS FOR:

• Palo Alto Networks Certified Network Security Engineer (PCNSE)
• Certified Cloud Security Professional (CCSP)
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified Ethical Hacker (CEH)

#LI-SS1

See more jobs at Brightspeed

Apply for this job

Job Description

JOB PURPOSE-

The Sr. Manager, Application Security at Skechers is a key member of our global information security leadership team who will work as a subject matter expert, trusted partner, and ambassador to help protect Skechers critical customer facing and core business applications. We are looking for someone who can help lead our practice; who appreciates that securing applications requires an end to end approach that accounts for the full development, integration, and operations lifecycle.

Skechers’ digital technology strategy demands an individual who is well versed in modern application development and public cloud infrastructure and brings a broad understanding of secure development and information security best practices. The candidate who will find the most success and fulfillment brings a genuine passion for information security, a love for learning, a positive attitude, a desire to roll up their sleeves and dive into the deep end, and a belief that being excellent doesn’t mean you have to give up on having fun. 

ESSENTIAL JOB RESULTS-

• Lead the team and practice responsible for application and cloud security at Skechers
• Remain accountable for the selection and maintenance of tools and technology which :
  • Help protect production applications, e.g. bot mitigation, code injection prevention, WAF, etc.
  • Support application risk assessment, secure code training, code review, etc.
  • Enable cloud security posture management, workload protection, and security monitoring
• Collaborate with various groups in the global technology organization on the development of standards and best practice guidelines and procedures
• Participate in the development of application security training plans and provide input on security awareness and secure coding initiatives
• Proactively identify potential issues at various stages of the SDLC and provide input on issue avoidance
• Work with development, cloud engineering, and devops teams to provide remediation guidance and perform post-remediation validation
• Coordinate and manage periodic application audits and manual penetration tests
• Plan and oversee internal and external security assessments and red team exercises
• Stay up-to-date and informed on changing IT and information security trends
• Create, communicate, and continuously monitor and improve metrics and KPIs
• Manage vendor relationships for both technology and operations
• Collaborate effectively with diverse internal teams to help drive security maturity
• Contribute positively to the culture of information security across the org

ADDITIONAL RESPONSIBILITIES-

• Other duties as assigned.

SUPERVISORY RESPONSIBILITIES-

• Yes

Qualifications

JOB REQUIREMENTS-

• Thorough understanding of common application security vulnerabilities and how to detect and fix them, including OWASP Top 10 and SANS CWE 25
• Significant experience with application security testing including static and dynamic analysis techniques and web app pentesting
• Understanding of general enterprise network and system components and their roles
• Familiarity with web application firewalls (CloudFlare, F5, ModSecurity, etc.)
• Experience with programming and scripting languages such as Java, .NET, Python, Perl, PowerShell, Scala, etc.
• Familiarity with libraries and frameworks such as Akka, Angular, React, Netty, Node.js, Play Framework, etc.
• Strong knowledge of network and application protocols and their associated security implications (TCP/IP, HTTP, TLS, SSH, DNS, etc.)
• Ability to communicate issues effectively to both technical and non-technical audiences
• Excellent written and oral communication skills
• Strong work ethic with attention to detail
• Ability to excel in a fast paced and rapidly changing environment

EDUCATION AND EXPERIENCE-

• 5+ years of experience in an application development and/or information security role
• 5+ years of management experience
• Proven ability to mentor, grow, and develop a team
• Experience programming as part of an enterprise development team a plus
• GIAC, (ISC)2, or Offensive Security Certification a plus

ADDITIONAL QUALIFICATIONS-

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily.  The skills, abilities and physical demands described are representative of those duties that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodation may be made to enable individuals with disabilities, who are otherwise qualified for the job position, to perform the essential functions.

PHYSICAL DEMANDS-

While performing the duties of this job, the employee is regularly required to stand; use hands to finger, handle, or feel, and talk or hear.  The employee frequently is required to walk; sit, reach with hands and arms, and stoop, kneel. The employee is occasionally required to sit for long period of times.  

See more jobs at Skechers

Apply for this job

See more jobs at Synack

Apply for this job

See more jobs at NEAR

Apply for this job

Apply for this job

Job Description

Block’s Offensive Security team is seeking a highly skilled and motivated Senior Offensive Security Engineer to join our team. In this role, you will play a critical role in proactively identifying and exploiting vulnerabilities within our systems and infrastructure, mimicking real-world attacker tactics. Your insights will be used to improve our overall security posture and ensure we stay ahead of evolving threats.

You will:

• Lead and execute complex Red Team engagements, simulating real-world attacker scenarios to uncover critical vulnerabilities across our network and applications.
• Identify, research, and exploit various vulnerabilities (including zero-days) to gain unauthorized access to systems and data.
• Develop custom tools, scripts, and exploit code.
• Document findings in a clear, concise, and actionable manner, including detailed reports with working proofs of concept and recommendations for remediation.
• Collaborate with the Blue Team and security leadership to prioritize vulnerabilities, develop mitigation strategies, and improve overall security posture.
• Participate in knowledge sharing by mentoring junior team members and presenting findings, including opportunities to present at external conferences.

Qualifications

You have:

• Minimum 5+ years of experience in offensive security engagements.
• Proven experience leading and executing Red Team engagements.
• Expertise in various operating systems (Mac, Linux, etc.) and scripting languages (Python, Ruby, etc.).
• Experience with exploit development and post-exploitation techniques.
• Excellent communication, collaboration, and problem-solving skills.
• Ability to work independently and manage multiple projects simultaneously.
• Strong understanding of the threat landscape and attacker motivations.

Bonus points for:

• Experience with responsible disclosure and publicly reported CVEs.
• Experience in a cloud environment (AWS, Azure, GCP).
• Experience in using C2s and developing and deploying custom C2 and implants.

See more jobs at Square

Apply for this job

See more jobs at Qlik

Apply for this job

See more jobs at Fastly

Apply for this job

See more jobs at FanDuel

Apply for this job

See more jobs at h2o.ai

Apply for this job

See more jobs at Newsela

Apply for this job

Job Description

Our IT Security team is looking for an Application Security Engineer to help our effort in protecting our corporate products and services, our internal solutions and the data managed by EcoVadis. 

You will be part of the team that collaborates in all areas of our Secure Software Development Lifecycle (SSDLC), with a predominant focus on enhancing the security of our code, ensuring that our developers follow the best practices to avoid vulnerabilities, promote automation inside the SSDLC, and collaborate with the team in executing different tests and reviews with a technical approach.

You will have the opportunity to make a significant impact and contribute to the overall success of our company.

This role will include the following responsibilities:

• Integrate SAST into SDLC:
  • Perform and maintain code analysis using one of industry-recognized SAST tools;
  • Exhibit knowledge and ability to integrate code scanning into the SSDLC (e.g. understand the basics of the code life-cycle and CI/CD platforms);
  • Understand the code to find and fix flaws that developers may have missed and help in the identification of false positives;
  • Help the engineering teams fix security issues, and mentor them to improve their security expertise.
• Conduct web application penetration tests:
  • Perform manual and automated application vulnerability assessments, document identified vulnerabilities and provide recommendations for remediation;
  • Exhibit knowledge and ability to perform industry standard web application penetration testing methods, including OWASP guides;
  • Plan and create penetration methods, scripts and tests, as well as to simulate security breaches in a secure manner.
• General Security Engineer responsibilities:
  • Ability to analyze security issues (both white-box and black-box), determine its cause and impact to the business, and identify the corrective action needed to eliminate and prevent the event from materializing in the future;
  • Work with IT Security team members and the development teams to design mitigation strategies for identified weaknesses, including the prioritization and contextualization of vulnerabilities;
  • Contribute to and help to further develop application security frameworks and standards;
  • Present your findings, risks and conclusions to different stakeholders (technical and non-technical);
  • Assist with other organization security projects and tasks as required;
  • Support the development and growth of Application Security practices and tools in the company;
  • Drive the efforts to automate operational security.

Qualifications

• A minimum of 3 years of professional experience in application security, penetration testing, or static code analysis;
• Proven track record of conducting successful penetration tests and security assessments on web applications or other software systems;
• Strong experience with static and dynamic code analysis tools and techniques, including code review and identifying code-level vulnerabilities;
• Familiarity with DevSecOps practices and integrating security into CI/CD pipelines;
• Experience with tools and frameworks commonly used in application security testing, such as Burp Suite, Kali linux, Metasploit, etc.;
• Familiarity with various programming languages (e.g., C#, Python, JavaScript, Java) and ability to understand and review code for security vulnerabilities;
• Proficiency in identifying, exploiting, and mitigating common security vulnerabilities (e.g., OWASP Top Ten) in web applications and APIs;
• Understanding of network protocols, operating systems, and databases, and their security implications;
• Basic knowledge of cloud security concepts and best practices (e.g., AWS, Azure, Google Cloud);
• Understanding of cryptography principles and secure authentication and authorization mechanisms;
• Ability to work independently;
• Ability to conduct research about areas unknown to him/her, and use that knowledge to deliver security guidelines and propose improvements;
• Open to work in an international, multilingual environment;
• Proficient in English (oral and written);
• Professional certification (e.g. OSCP or OSWE) is a plus;
• Hands-on experience with Google Workspace is a plus.

See more jobs at EcoVadis

Apply for this job