PRINCIPAL DUTIES AND RESPONSIBILITIES :
- Provide guidance to development teams to help define security requirements and security testing strategies
- Make implementation design decisions for software tools and scripts to facilitate security testing, and for technical solutions to vulnerabilities in code
- Propose solutions for executing scans for new and legacy functionality using automated tools, and review results identify potential areas of improvement in existing software and scanning process
- Uphold best practices for monitoring open vulnerabilities and driving issues to resolution
- Uphold best practices for reviewing new code and infrastructure for potential vulnerabilities, and for developing security testing strategies
- Uphold best practices for security audits and penetration tests of new and legacy functionality
- Uphold best practices for creating vulnerability reports for security audits and penetration tests
- Uphold best practices for estimating level of effort of tasks when collaborating with teams
- Review documentation of security best practices from other QA engineers and propose improvements
- Review security metrics to assess effectiveness of department and identify potential areas of improvement
- Review work of junior QA engineers to provide input and mentorship as needed
- Work closely with various software development teams to assist in software security testing
- All other duties as assigned
MINIMUM QUALIFICATIONS AND REQUIREMENTS :
Bachelors Degree in Computer Science, or equivalent experience4 to 6 years of industry experience in security testing for web applications, mobile applications and / or large-scale enterprise products3+ years of industry experience in software penetration testing, including reviewing newly developed code, auditing legacy applications, and running automated scansAdvanced understanding of networking conceptsAdvanced understanding of software development processesAdvanced understanding of established security standards (OWASP Top 10, SANS CIS CSC)Advanced understanding of software security development practices (cryptography, authentication)Strong proficiency with relational databases and data structures (T-SQL, MySQL, NoSQL)Strong proficiency with large-scale analytics platforms (New Relic, Splunk)Strong proficiency writing code in OOP and / or scripting languagesHands-on experience guiding software development team in best practices for security testing and in defining security requirementsHands-on experience researching and documenting best practices for security testingHands-on experience providing guidance to junior team membersProven ability to communicate professionally, both verbally and in writingSkills Required
Software Development, Scripting Languages, Data Structure, Communication