VAPT Pentester / Web Application Security

Bangalore, Karnataka
Permanent
Full-time

2 months ago

Greetings from Netsach - A Cyber Security Company.We are looking for Web Application Security with 3 yrs of relevant experience and mandatory skills set are Web Application Security, Security Code review, API security, Underlying infrastructure security, Integration Security, Database Security, Secure Configuration Review.Job Title: Web Application SecurityExp: 3+ - 5yrsJob Location: BangaloreJob Type: Full-timeInterested candidates please share your resume at and netsachglobal.comJob Description1. Job OverviewThe primary purpose is to Design, Engineer & eventually Embed practical & balanced cyber / information security principles/patterns/controls into all products and platforms. Conduct security assessments, gap analysis, provide remediation to the relevant squads / stakeholders.2. Job PurposePrimary/General Job Purpose:

Encourage Shift Left Mindset - Proactively embed security requirements, by influencing implementation of security & privacy patterns from the start of the development cycle

Implement via Influence - Influence stakeholders such as Product Owners, Solution Architects, Developers, Testers, Engineers & others to include security patterns into features, epics and stories in order to build secure, innovative & superior digital products for customers and employees

Assessments Perform security assessment and perform gap analysis to provide appropriate remediations to the teams for implementing the fixes.

Key Skills Web Application Security, Security Code review, API security, Underlying infrastructure security, Integration Security, Database Security, Secure Configuration Review.

Tools and Technologies Burp Suite, Postman, Tenable Nessus, Checkmarx SAST, GitHub and good knowledge about monolithic and microservice architecture and pipeline driven security.

Experience with following Components:3. Technical RequirementsApplication Security Assessment Skillset * Web Application Security Owasp top 10 , CVSS etc

Security Code Review manual code review in Git etc
API Security Review Open shift, container review etc.
Database Security Requirements to enhance security on Database
Web Server Security Requirements to enhance security on the web server
Configuration Review has performed different configuration reviews and should have found good misconfigurations in the system.
Integration review How the application connects with different systems, performed security review on those integrations.
Transport Layer Security How communication channels are secured and understanding of the Transport layer security mechanisms and controls.

Soft Skills:

Ability to collaborate with multiple stakeholders and manage their expectations from a security perspective
Holistic thinking; must balance security and functionality using practical demonstrable examples. Must also contribute to and implement good architecture principles to lower technical debt
Assertive personality; should be able to hold her/his own in a project board or work group setting
Superlative written and verbal communication skills; should be able to explain technical observations in an easy-to-understand manner
Ability to work under pressure and meet tough/challenging deadlines
Influencer- must be able to convince various stakeholders (internal IT Teams, C-Level execs, Risk & Audit) of why a certain observation is a concern or not
Strong understanding of Risk Management Framework and security controls implementation from an implementer standpoint
Has strong decision making, planning and time management skills.
Can work independently.
Has a positive and constructive attitude.

4. Person SpecificationsSpecificationsDescription of Knowledge / Skill etc.Desirable or Essential

Education

General
Professional

Bachelors degree in a computer-related field such as computer science, cyber/information security discipline, physics, mathematics or similar

General Information Security:OSCP, CEH, CISM/CISA or similar
General Cloud Security: CCSK /CCSP or similar
Specific Cloud Security: Azure Security or similar
Network Security: CCNA, CCNP, CCIE, Certified Kubernetes Security Specialist

Experiences

(Years & Type)

Industry
Regional
Functional

Must have minimum 3 years of experience in an information security function with good background in information technology, stakeholder management and people management

Knowledge & Skills

Technical
Functional
Managerial

Expert at the Web application Security testing, in depth testing skillset and ability to bypass weak implementation for attacks, ability to bypass WAF for attack scenarios such as XSS, SQL Injection etc.Good understanding of Microservice based architecture (Technical)Good hands-on experience solutioning technology architectures that involve perimeter protection, core protection and end-point protection/detection & API /Micro services SecurityExperience working in a DevOps environment with knowledge of Continuous Integration, Containers, DAST/SAST tools and building Evil Stories (Technical)The Analyst / Engineer should be able to understand how different systems work and what security controls are implemented in such integrations.The Analyst / Engineer should be capable in understanding the hardening standards, creating one if not available, and perform the testing against the hardening standards.The Analyst / Engineer should be capable of assessing security flaws in underlying infrastructure and the connected components.The Analyst / Engineer should be capable of assessing the security flaws in the Transport Layer.The Analyst / Engineer has the skill to follow design principles and applies design patterns to enforce maintainable and reusable patterns, in the form of code or otherwiseThe Analyst / Engineer can understand and interpret potential issues found in source or compiled codeThe Analyst / Engineer has automation skills/capability in the form of scripting or similarThe Analyst / Engineer can attack application and infrastructure assets, interpret threats, and suggest mitigating measuresAbility to interpret Security Requirements mandated by oversight functions and ensure comprehensive coverage of those requirements, via documentation, within high level design and/or during agile ceremonies, via Evil StoriesDesirableThe Analyst / Engineer can propose options for solutions to the security requirements / patterns that provide a balance of security, user experience & performanceDesirableThe Analyst / Engineer has the skill to discuss and present solutions to other architecture, security, development, and leadership teams.DesirableThe Analyst / Engineer can interpret and understand vulnerability assessment reports and calculate inherent and/or residual risks based on the assessment of such reportsDesirableAbility to articulate and be a persuasive leader who can serve as an effective member of the senior management team.Good negotiation skills will be desirableDesirableMust have good judgment skills to decide on an exception approvalDesirableAbility to enforce improvements when necessary, using Influence rather than Policing measuresDesirableSuperior written and verbal communication skills to effectively communicate security threats and recommendations to technical or non-technical stakeholdersDesirableKnowledge of application of Agile methodologies/principles such as Scrum or KanbanDesirable * Behavioral Competencies

Thinking Related
People Related
Self Related
Influencer/Security Evangelist for the Team/Squad
Positive & Constructive Attitude
Autonomous worker / Decision Maker
Good listener
Patient & Calm during stressful situations
High energy individual / Motivator
Win-Win Attitude
Hacker/Defense-In-Depth mindset
Analytical thinking
Team Player/Interpersonal Skills
Eye for detail
Persistent & Persuasive
Organized / Structured
Deadline oriented
Competent and committed
Peoples Person; understands stakeholder management
Empathetic
Passionate about architecting smart solutions
Innovator/Out of the box thinker
Collaborative Leadership style
Confident Presenter

Thank YouEmily JhaNetsach - A Cyber Security Company+91 8050023824

Expertia AI Technologies

Apply Now