Threat and Exploitation Analyst

Role/Job Title: Threat and Exploitation Analyst

Function/ Department: Risk

Job Purpose:

We are seeking a skilled Application Security Engineer with expertise in code review to help safeguard our software products. The ideal candidate will have a strong background in secure coding practices, vulnerability identification, and remediation within software applications. You will collaborate closely with development teams to ensure code is secure and compliant with industry standards.

Roles & Responsibilities:

Application security and Code Review:

• Must have rich experience in performing application security assessment (Web, mobile, thick client), API security assessment and secure code review.
• Should have performed Mobile Application security for both the platforms Android and iOS.
• Conduct comprehensive code reviews for security vulnerabilities in both manual and automated settings.
• Identify and mitigate security risks.
• Recommend remediation strategies and assist developers with secure coding best practices.
• Security Testing:
• Integrate and maintain static and dynamic code analysis tools (SAST/DAST) for continuous security testing.
• Perform security assessments for new and existing applications (web, mobile, thick-client) and APIs.
• Collaboration and Training:
• Work closely with development teams to guide them in explaining and remediating the vulnerabilities.
• Security Architecture Review:
• Participate in architecture reviews to ensure security is built into the software development lifecycle (SDLC) from the ground up.
• Assist in designing and implementing security frameworks and controls.
• Documentation and Compliance:
• Maintain and update security guidelines, processes, and documentation.
• Review the content of the vulnerabilities reported.
• Ensure compliance with security policies and relevant regulatory requirements required for the bank.
• 3-5 years of experience in application security, with a focus on code review, application security and vulnerability remediation.
• Strong knowledge of secure coding practices in programming languages such as Java, C#, Python, JavaScript, PHP, etc.
• Experience with SAST and DAST tools (e.g., Checkmarx, Fortify, Burp Suite, Postman).
• Familiarity with OWASP Top 10, SANS 25, and other application security standards.

Education Details:

• Bachelors degree in computer science, Information Security, or a related field, or equivalent practical experience.

Preferred Qualifications:

• Industry certifications such as CISSP, CEH, OSCP, or CSSLP.
• Experience in penetration testing or ethical hacking.
• Familiarity with container security (Docker, Kubernetes) and cloud security (AWS, Azure, GCP).
• Strong problem-solving skills and attention to details.

Experience: 5 to 10 years of relevant experience.