Junior Application Security Engineer

Cossack Labs

Що робити

Perform security assessment and review of code and behaviour of systems (web, API, backends, Linux). Mostly whitebox, occasional blackbox.
Perform security search for weaknesses and vulnerabilities in software in novel fields and areas.
Participate in SSDLC for our products and our customers’ products. Explain risks & threats, work with developers to select security controls that would improve security without restricting usability/performance.
Dive into application security, infrastructure security, cloud and on-prem infrastructures, dedicated hardware, IoT security, ML security, and weird stuff beyond casual imagination with our team of skilled engineers. Check out an example of our work.
Stay updated with emerging security threats, vulnerabilities, and controls by reading articles, papers, and NIST guidelines. Follow CVE updates and understand how the threat landscape is changing.

1+ years as an Application Security Engineer or similar position.
Experience in performing security assessment for web applications and cloud systems.
Be familiar with application security verification frameworks: OWASP ASVS.
Understanding SSDLC and its difficulties: OWASP SSDLC, NIST SSDF.
An overall understanding of what information security is, how real-world risks and threats affect the choice of security controls. How to combine detective, preventive and corrective controls.