Engineer II - Security Engineer

What you'll be doing...

You'll be part of the GTS Application Security team working on DAST tools like ZAP, Burrp Suite, Postman etc and collaborating with application teams to fulfill the application security objectives Some of your daily responsibilities would be the following.

• Assisting application teams to setting up environments for Dynamic Application Security Testing (DAST)
• Assisting teams in defining functional and security test cases / suites for security testing
• Managing maintaining, optimizing and securing the ZAP Jenkins infrastructure used for security testing
• Troubleshooting and resolving ZAP scan related issues that may arise as part of the DAST workflow/lifecycle
• Leveraging tools like Burrp Suite for manual security testing for apps out of scope for automated testing
• Reviewing scan reports & provide guidance to mitigate risks that arise due to of poor business logic/ coding practices
• Validating reported vulnerabilities , false/true positive review requests raised by application teams
• Assisting teams with manual scans for applications that cannot be scanned via automated DAST.
• Demonstrating the ability to support a dynamic environment with a penchant for process development and automation

What we're looking for...

You are passionate about application security as a career. You are self-driven and motivated, with good communication and analytical skills. You're a sought-after team member that thrives in a dynamic work environment.

You will be working with multiple partners from the business groups, so networking and managing effective working relationships should be your top most priority. You have an understanding of industry trends in all areas of Information Security.

You'll need to have:

• Bachelor's degree in Computer Science Engineering with one ore more years of work experience.
• Understanding of software development life cycle, design, functional/security testing methodologies
• Knowledge of HTTP Protocol, web services, API security technologies REST, SOAP, GraphQL etc.
• Knowledge of Common Software vulnerabilities like OWASP Top 10 / Sans Top 25 and controls for secure software
• Knowledge of Defensive Coding Practices , concepts and techniques, security testing methodologies etc
• Stay abreast with emerging technologies, application security trends, tools and techniques.

Even better if you have one or more of the following:

• Industry relevant security certifications eJPT,, Security+, CEH, OSCP, GIAC or any relevant application/API security certifications
• Experience in mobile application development /security testing methodologies.