Application Security Engineer | Mid-Senior | Low-level

Nord Security creates solutions for online security, privacy, and data protection, including VPNs, password managers, threat intelligence, and eSIMs for travel.

• Proven experience in mobile and desktop application security assessment planning, testing methodologies, and vulnerability reporting.
• Strong understanding of secure coding practices.
• Ability to perform manual security code audits.
• Proficiency in at least one low-level programming language such as C, C++, Rust, or Go.
• Solid understanding of networking protocols including TCP, UDP, and HTTP.
• Familiarity with debuggers like GDB, LLDB, and WinDbg.
• Familiarity with reverse engineering tools like Ghidra and IDA.
• Solid understanding of memory corruption issues, buffer overflows, and related vulnerabilities.
• Familiarity with authentication and authorization protocols such as OAuth, SAML, and JWT.
• Ability to work with networking tools like Wireshark and tcpdump.
• Ability to quickly assimilate new technologies and tools.
• Strong problem solving, investigation skills, and sense of ownership.
• Ability to build and maintain relationships and influence key stakeholders.
• Bonus: community contributions like public CVEs, bug bounty recognition, open-source tools, or blogs.

• Conduct security reviews of application designs, source code, and third-party libraries.
• Perform regular application vulnerability assessments using automated tools and manual testing techniques such as SAST, DAST, SCA, and penetration testing.
• Collaborate with development teams to design secure architectures and implement security controls.
• Help maintain security tools, scripts, and processes to support secure development.
• Stay current with industry trends, zero-day vulnerabilities, and application security best practices.
• Develop scripts and security automation tools to enhance application security testing.
• Design and deliver training for security engineering awareness and adoption.
• Actively look for internal security gaps within the product or organization.
• Ensure mobile and desktop applications are sufficiently tested and support internal and external audits.

Candidates must provide accurate and complete information during recruitment. Limited AI tool use for application refinement is allowed but candidates are fully responsible for their submissions. Automated tools may be used for evaluation purposes in the hiring process. Candidates may opt out of automated evaluation by contacting specified addresses.