Netsentries Application Security Engineers will perform code-aware security assessments, Threat Modeling, SAST, SCA, Security Engineering reviews, etc., of enterprise Web/Mobile applications on different platforms developed in various programming languages. They will work closely with the Netsentries AppSec and client development teams to remedy the identified vulnerabilities.
Core responsibilities include:
Perform in-depth static secure code analysis with open source and commercial tools
Perform Threat Modeling and in-depth manual secure code reviews
Perform security engineering reviews
Reverse Engineering App binaries and analyzing the decompiled/disassembled code
Prepare advisory for developers of the application on secure coding practices for addressing vulnerabilities identified
Experience with assessments based on standards like etc.
Collecting evidence to demonstrate the findings
Collaborating with client-side application security and development teams
Handle enterprise SAST projects involving a variety of programming languages including and not limited to web applications with Java, .NET, etc., Android and iOS mobile applications programming languages
Execute code-aware security assessments in adherence with industry standards like
OWASP ASVS,OWASP MASVS,OWASP Top10, OWASP Mobile Top 10, SANS 25, PCI-DSS, HIPAA, MITRE-CWE etc.
Experience with enterprise SAST projects involving a variety of programming languages including and not limited to web applications with Java, .NET, etc., Android and iOS mobile applications programming languages
Skills Required:
A degree in computer science or related field and/or equivalent experience in software development.
Exposure to industry standard development practices and programming languages would be a plus.
Demonstrable understanding of enterprise architectures and best practices for high-volume, high-availability web / mobile apps.
Excellent interpersonal communications skills.
Experience with Android / iOS mobile platforms
Experience in performing secure code reviews / reviewing results of static analysis tools
Knowledge of Common Weakness Enumeration (CWE) and Common Vulnerabilities & Exposures (CVE) and their remediation recommendations
Familiarity of vulnerabilities and attack methods, including Remote Code Execution (RCE), Cross-Site Scripting (XSS), SQL Injection (SQLi), etc. and how to identify, trace and remediate them
Understanding of OWASP Top 10
Certifications like OSWE is preferred
Experience working with commercial SAST/SCA solutions like Checkmarx,Veracode,Synopsis etc. is an advantage.