VAPT Pentester / Web Application Security

Greetings from Netsach - A Cyber Security Company.

We are looking for Web Application Security with 3 yrs of relevant experience and mandatory skills set are Web Application Security, Security Code review, API security, Underlying infrastructure security, Integration Security, Database Security, Secure Configuration Review.

Job Title : Web Application Security

Exp : 3+ - 5yrs

Job Location : Bangalore

Job Type : Full-time

Interested candidates please share your resume at and netsachglobal.com

Job Description

1. Job Overview

The primary purpose is to Design, Engineer & eventually Embed practical & balanced cyber / information security principles / patterns / controls into all products and platforms. Conduct security assessments, gap analysis, provide remediation to the relevant squads / stakeholders.

2. Job Purpose

Primary / General Job Purpose :

• Encourage Shift Left Mindset - Proactively embed security requirements, by influencing implementation of security & privacy patterns from the start of the development cycle
• Implement via Influence - Influence stakeholders such as Product Owners, Solution Architects, Developers, Testers, Engineers & others to include security patterns into features, epics and stories in order to build secure, innovative & superior digital products for customers and employees
• Assessments Perform security assessment and perform gap analysis to provide appropriate remediations to the teams for implementing the fixes.

Key Skills Web Application Security, Security Code review, API security, Underlying infrastructure security, Integration Security, Database Security, Secure Configuration Review.

Experience with following Components :

3. Technical Requirements

Application Security Assessment Skillset

Soft Skills :

4. Person Specifications

Specifications

Description of Knowledge / Skill etc.

Desirable or Essential

Bachelors degree in a computer-related field such as computer science, cyber / information security discipline, physics, mathematics or similar

(Years & Type)

Must have minimum 3 years of experience in an information security function with good background in information technology, stakeholder management and people management

Expert at the Web application Security testing, in depth testing skillset and ability to bypass weak implementation for attacks, ability to bypass WAF for attack scenarios such as XSS, SQL Injection etc.

Good understanding of Microservice based architecture (Technical)

Good hands-on experience solutioning technology architectures that involve perimeter protection, core protection and end-point protection / detection & API / Micro services Security

Experience working in a DevOps environment with knowledge of Continuous Integration, Containers, DAST / SAST tools and building Evil Stories (Technical)

The Analyst / Engineer should be able to understand how different systems work and what security controls are implemented in such integrations.

The Analyst / Engineer should be capable in understanding the hardening standards, creating one if not available, and perform the testing against the hardening standards.

The Analyst / Engineer should be capable of assessing security flaws in underlying infrastructure and the connected components.

The Analyst / Engineer should be capable of assessing the security flaws in the Transport Layer.

The Analyst / Engineer has the skill to follow design principles and applies design patterns to enforce maintainable and reusable patterns, in the form of code or otherwise

The Analyst / Engineer can understand and interpret potential issues found in source or compiled code

The Analyst / Engineer has automation skills / capability in the form of scripting or similar

The Analyst / Engineer can attack application and infrastructure assets, interpret threats, and suggest mitigating measures

Ability to interpret Security Requirements mandated by oversight functions and ensure comprehensive coverage of those requirements, via documentation, within high level design and / or during agile ceremonies, via Evil Stories

Desirable

The Analyst / Engineer can propose options for solutions to the security requirements / patterns that provide a balance of security, user experience & performance

Desirable

The Analyst / Engineer has the skill to discuss and present solutions to other architecture, security, development, and leadership teams.

Desirable

The Analyst / Engineer can interpret and understand vulnerability assessment reports and calculate inherent and / or residual risks based on the assessment of such reports

Desirable

Ability to articulate and be a persuasive leader who can serve as an effective member of the senior management team.

Good negotiation skills will be desirable

Desirable

Must have good judgment skills to decide on an exception approval

Desirable

Ability to enforce improvements when necessary, using Influence rather than Policing measures

Desirable

Superior written and verbal communication skills to effectively communicate security threats and recommendations to technical or non-technical stakeholders

Desirable

Knowledge of application of Agile methodologies / principles such as Scrum or Kanban

Desirable

Thank You

Emily Jha

Netsach - A Cyber Security Company