Senior Vulnerability & Application Security Engineer

Brak informacji o wynagrodzeniu

SeniorHybryda·WrocławFull-time

#474181·Dodano dziś·0

Źródło: nofluffjobs.com

Aplikuj teraz

Tech Stack / Keywords

WirelessSecurityTestingManual TestingWiresharkNessusC C++C#Java ASP.NET Perl Python OWASPTCPNetwork SecurityAIAndroid iOSCommunication skillsDevOpsIPSrisk managementOSCPCISSPCISMCISAMicrosoft Azure AWS Amazon Web Services GCP Google Cloud PlatformDegree

Podsumowanie oferty

You will support the Technology Assurance team with security assurance for EY’s deployed technology, including application security reviews and vulnerability assessments. The work includes application security testing, vulnerability assessment, and continuous security scanning in CI/CD pipelines.

Wymagania

Hands-on experience testing the security of web, thick-client, mobile, VOIP, and wireless applications.
Proficiency in automated and manual application testing methodologies.
Expertise with manual testing tools such as Burp Professional, Nmap, Wireshark, Nessus, and echomirage.
Expertise with automated application scanning tools such as WebInspect, Qualys WAS, CheckMarx, and WhiteSource.
Basic knowledge of C/C++, C#, Java, and ASP.NET, and familiarity with Perl and Python scripting.
Basic understanding of secure coding principles and common coding vulnerabilities, such as the OWASP Top Ten, for identifying vulnerabilities during code reviews and collaborating with development teams.
Knowledge of common security requirements for ASP.NET and Java applications.
Good knowledge of TCP/IP and network security.
Hands-on experience testing projects integrated with AI.
Ability to test Android and iOS applications.
Knowledge of how to perform manual code reviews.
Good technical aptitude, problem-solving ability, and ability to learn new topics and domains quickly.
Excellent written and verbal communication skills.
Ability to explain complex security concepts to non-technical stakeholders and provide clear guidance to developers and architects.
5 to 8 years of experience in application security assessment.
Hands-on experience with web, thick-client, and mobile application security reviews.
Exposure to and good understanding of manual testing methodologies.
Knowledge of how vulnerabilities can lead to incidents and of the role of vulnerability assessments in incident detection and response.
Understanding of application, network, and system architectures from a security perspective, including controls such as firewalls, IDS/IPS, and encryption.
Ability to multitask and prioritize duties.
Ability to work with vendors and diverse teams across the organization, aligning security goals with business objectives.
Ability to communicate the status of risks and mitigation efforts to stakeholders, including executives, developers, and other relevant teams.
Ability to adjust risk management strategy as applications evolve, new threats emerge, and the business landscape changes.

Nice to have:

Bachelor’s degree or higher in Information Technology, Cyber Security, or a related discipline.
Interest in pursuing relevant information security certifications, such as CEH, OSCP, CISSP, CISM, CISA, Microsoft Azure, AWS (Amazon Web Services), or GCP (Google Cloud Platform).

Obowiązki

Prepare detailed security review reports and remediation guidance.
Research new application security vulnerabilities and attack vectors.
Support the team in updating its skills and knowledge.
Lead strategic initiatives and mentor new team members.
Continuously improve service quality.
Configure, manage, and update vulnerability assessment tools to ensure they operate optimally and provide accurate results.
Work with development teams to configure and use self-scan tools within the development lifecycle.
Guide developers in interpreting scan results, identifying false positives, and prioritizing remediation efforts.
Automate scanning processes in the CI/CD pipeline for continuous security testing as code is developed, committed, and deployed.
Explain SASP (Secure Application & System Policy) and its implementation guide.
Manage customers across different time zones and cultures.
Work with security consulting and cross-functional teams, including development, project managers, DevOps engineers, vendors, and product management.

Benefity

Continuous learning to develop the mindset and skills to navigate what comes next.
Tools and flexibility to make a meaningful impact.
Insights, coaching, and confidence to develop leadership skills.

EY GDS

40 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz