Senior Application Security Engineer

Senior Application Security Engineer (Chief Expert) at Usetech. Remote work, 3+ years experience. Salary discussed at interview.

Responsibilities: • Ensure information security at all stages of the project lifecycle, from pre-project analysis to implementation and subsequent control. • Conduct expertise of solution architecture for compliance with IS requirements, participate in approval of organizational, administrative, architectural and technical documentation. • Model threat scenarios, assess and review information security risks. • Analyze development plans and backlog, form security requirements for new features and advise teams on secure code, architecture and IS requirements. • Conduct Code Review, analyze results of manual and automated vulnerability search, prioritize their remediation and control fixes. • Participate in investigation of information security incidents.

Requirements: • Higher education in information security and at least 4 years of practical experience in security assessment and expertise of architectural documentation. • Deep knowledge of information security fundamentals: protocols, information security tools, PKI and principles of cryptographic algorithms. • Expertise in Application Security: identification and elimination of OWASP Top 10, OWASP Mobile Top 10, CWE Top 25 vulnerabilities, knowledge of web application security practices. • Experience in analyzing architecture of information systems and project documentation, including identifying vulnerabilities in business logic, developing and justifying protection mechanisms. • Understanding of modern web application architecture, microservices, containerization, CI/CD and secure development processes (SSDLC). Programming and source code analysis skills. • Knowledge of regulatory requirements in information security, ability to determine their applicability to developed functionality and transform them into specific technical protection measures. • Proficiency in risk-based approach methodology: qualitative risk assessment and threat scenario modeling. • Expert proficiency in Burp Suite: using custom extensions, building multi-stage attacks and combining techniques. • Strong communication skills: interaction with business, IT and project teams, conflict resolution, compromise finding, reasoned defense of decisions, conducting discussions and presentations, constructive feedback and maintaining productive dialogue.

Location: Remote possible. Salary: Discussed at interview.