Remote Senior Application Security Engineer

Required Skills & Experience

-6+ years of experience with Information Technology, with experience in cybersecurity or application security. -3+ years of experience with Java, Python, .NET, or C# -3+ years of experience using Burp Suite DAST to perform Dynamic Application Security Testing (DAST). -2+ years of experience with Static Application Security Testing (SAST), using tools such as Veracode. -3+ years of experience designing and implementation enterprise-wide security controls to secure applications, systems, networks, or infrastructure services -3+ years of experience with Linux or UNIX environments, including system navigation and troubleshooting basic website connectivity issues. -2+ years of experience with Veracode and development environments such as Eclipse, JDeveloper, including pipeline development and integration. -Experience with securing enterprise web applications and frameworks, including OWASP Top 10, CVSS, CWE, WASC, and SANS-25 -Knowledge of federal security and compliance standards, including NIST 800-53, FIPS, or FedRAMP -Ability to obtain and maintain a Public Trust or Suitability/Fitness determination based on client requirements -HS diploma or GED

Nice to Have Skills & Experience

-Experience with Interactive Application Security Testing (IAST) capabilities and tools Bachelor’s Degree -This person is supporting Booz on the SEC program and is responsible for securing the SEC’s web applications. Day to day, they’re running security scans against applications, finding vulnerabilities, figuring out what is causing them, and working with developers to get them fixed.

The biggest thing we need is Burp Suite Enterprise specifically for DAST scanning. We’re finding candidates with Burp Professional, but that alone isn’t what the manager needs. They also need Veracode for SAST, Linux experience, and enough coding or scripting knowledge to understand the applications and work effectively with developers.

Job Description

The areas of focus are Burp Enterprise experience performing DAST scanning. We are finding many candidates have experience with Burp Professional, but this is focused on SAST scanning. They should also have Veracode experience performing SAST scanning. They need to know their way around a Linux environment and some type of coding and/or scripting experience is preferred.