Poppulo is seeking an Application Security Engineer to join our security team
The role of the Application Security Engineer is to identify and anticipate vulnerabilities to protect Poppulo assets
They will utilize established and create new processes and capabilities to focus on vulnerability management, secure code development, software development lifecycles, and security assessments
The Application Security Engineer will support the development and maintenance of business continuity planning, data, systems, and network security for systems and controls related to their job duties
The Application Security Engineer will report to the Sr Director of Information Security Operations; this position is not a management position
Key Responsibilities
Perform and support application security reviews, consulting, testing in coordination with developer operations, and threat modeling (using DREAD and STRIDE), including code review and dynamic testing.
Own and perform application security vulnerability management.
Support the bug bounty program.
Facilitate and support the preparation of security releases.
Support and consult with product and development teams regarding application security.
Assist in creation of secure code training to end-users and developers.
Assist in development of automated security testing to validate that secure coding best practices are being used.
Participate in the planning, implementing, and managing of application security measures/technologies to protect the organizations information systems and networks.
Assist with the review, development, and implementation of application security policies, procedures, and service documentation.
Monitoring application security systems to identify alerts and response efforts for potential application security events/findings.
Develop and mentor junior staff through open communication, training and development opportunities, and celebrate their success.
Facilitate our secure SDLC (Software Development Life Cycle) which includes AVS (Application Vulnerability Scanning) scanning, SD3+C, and PD3+C methodologies, etc
Manual Penetration Testing of our Products and Vendor Products.
Develop detailed vulnerability reports for application owners and management teams.
Conduct detailed penetration test report read-outs with application owners and management teams and provide remediation recommendations.
Participate in On-Call rotations.
Other responsibilities, as required.
Education Experience :
Bachelors degree in Computer Science, Information Systems, Cyber Security related field, or equivalent experience.
One or more security-based certifications preferred, such as CISSP, Security +, GWEB, GWAPT, etc
3+ years experience in some form of information security discipline; Information Security Engineering, Application Security Engineering, etc
3+ years of experience performing network and application security testing.
5+ years of experience in software engineering working in .NET, JavaScript, React, HTML, AWS (Amazon Web Services) Micro Services, Python, and AWS-based lambda.
2+ years working on security principles in software engineering with strong knowledge in Open Web Application Security Project (OWASP) security principles.
Experience with the NIST or ISO 27001/2 security frameworks.
Experience with the participation of SOC-based independent audits a plus.
Ability to use GitLab/GitHub/CICD Pipelines.
Familiarity with common security libraries, security controls, and common security flaws.
Basic development or scripting experience and skills.
Experience with OWASP, static/dynamic analysis, and common security tools.
A basic understanding of network and web related protocols (such as TCP/IP, UDP, protocols).
Experience working with developers.
Excellent and professional communication skills (written and verbal) with an ability to articulate complex topics in a clear and concise manner.
Experience identifying security issues through code review.
Strong problem-solving skills and self-motivation to learn and upskill regularly.
Experience working in a global hybrid environment with teams applying an agile methodology.
The ability to work independently and across functional teams while developing key working relationships.
IT (Information Technology) experience and understanding of common devices, equipment, environments, network diagrams systems.
Extraordinary communication (verbally and written) and problem-solving skills with an ability to deliver on time and work with minimal direction.
Proven record of producing documentation relating to application services.
Preferred:
Experience working asynchronously.
Involvement in local or regional security user groups or conferences.
A team-first, collaborative approach.
Ability to explain complex technical issues clearly and confidently in simple and understandable terms.
Must be able to adapt quickly to ever changing requirements and priorities.
