[Hiring] Application Penetration Tester @ASM Research

Role Description

As an Application Security Penetration Tester, you will be entrusted with the critical responsibility of safeguarding web applications and REST APIs from potential threats. Your role will require a deep understanding of the OWASP Top 10 and SANS 25, as these frameworks will guide your efforts in identifying and mitigating security vulnerabilities.

• Perform thorough security assessments of third-party libraries and analyze dependencies.
• Conduct both automated and manual code reviews.
• Uncover a range of security issues, including:
  • Cross-Site Request Forgery (CSRF)
  • Cross-Site Scripting (XSS)
  • SQL Injection
  • Privilege Escalation
• Provide actionable recommendations for remediation.
• Master tools like BurpSuite for dynamic and penetration security testing.
• Write comprehensive reports detailing findings and suggesting enhancements to bolster system security.
• Serve as a bridge between development teams and stakeholders to ensure security requirements are communicated and understood.
• Define, maintain, and enforce application security best practices.
• Involved in software security architecture and design reviews.
• Familiarity with Continuous Integration and Continuous Deployment (CI/CD) for integrating and automating security tools within DevOps processes.

Qualifications

• 3 years of experience in Secure Code Review, specifically with languages such as Scala, Java, JavaScript, and Spring Framework.
• 3 years of practical experience with Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST).
• 3+ years of hands-on experience with manual penetration testing of Web Applications and REST APIs using BurpSuite Pro and Postman/Bruno.
• Deep understanding of Secure Coding best practices and DevSecOps principles.
• Proficiency of OWASP Top 10 and SANS 25 standards and testing guidelines.
• Knowledge of Continuous Integration and Continuous Deployment (CI/CD), AWS Security principles, Jenkins, and GitHub.

Requirements

• Serve as a liaison between development teams and stakeholders to understand and formulate security requirements.
• Define, maintain, and enforce application security best practices.
• Conduct vulnerability assessment and manual/automated code review of Java and Scala applications to find security vulnerabilities and recommend remediation.
• Analyze scan reports from varied tools (SAST, DAST, and SCA) to identify issues and provide recommendations to remediate vulnerabilities across various applications, programming languages, and platforms.
• Conduct static, dynamic, and penetration security testing of Web Applications and REST APIs.
• Perform software security architecture and design reviews.
• Write comprehensive reports including assessment-based findings and propositions for further system security enhancement.
• Identify and demonstrate vulnerabilities to application owners and recommend remediation for security vulnerabilities.
• Knowledge of scripting language to integrate and automate security tools within DevOps CI/CD processes.

Benefits

• Compensation ranges for ASM Research positions vary depending on multiple factors, including but not limited to location, skill set, level of education, certifications, client requirements, contract-specific affordability, government clearance and investigation level, and years of experience.
• The compensation displayed for this role is a general guideline based on these factors and is unique to each role.
• Monetary compensation is one component of ASM's overall compensation and benefits package for employees.

Company Description

It is the policy of ASM that an individual's race, color, religion, sex, disability, age, sexual orientation, or national origin are not and will not be considered in any personnel or management decisions. We affirm our commitment to these fundamental policies.

• All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, disability, or age.
• All decisions on employment are made to abide by the principle of equal employment.