Application Security Engineer

OVA.Work is seeking an experienced Application Security Engineer to ensure the security of software applications throughout the Software Development Life Cycle (SDLC). The ideal candidate will identify security vulnerabilities, conduct secure code reviews, perform application security testing, and implement DevSecOps practices.

Responsibilities:

• Integrate security practices into the SDLC (Secure SDLC)
• Perform Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA)
• Conduct secure code reviews for web, mobile, and backend applications
• Identify, assess, and remediate application security vulnerabilities
• Perform threat modeling and security risk assessments
• Implement DevSecOps security controls in CI/CD pipelines
• Conduct penetration testing and vulnerability assessments
• Validate authentication, authorization, session management, and API security
• Secure cloud-native and containerized applications
• Collaborate with developers, DevOps, QA, and infrastructure teams
• Develop security standards, guidelines, and best practices
• Support compliance with industry regulations and security frameworks

Requirements:

• Secure Software Development Life Cycle (SSDLC)
• Secure Coding Practices
• Threat Modeling
• Secure Design Principles
• Risk Assessment
• Vulnerability Management
• Security Architecture
• Security Code Reviews
• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Interactive Application Security Testing (IAST)
• Software Composition Analysis (SCA)
• Runtime Application Self-Protection (RASP)
• Mobile Application Security Testing (MAST)
• API Security Testing
• Burp Suite
• OWASP ZAP
• Checkmarx
• Veracode
• Fortify
• SonarQube
• Snyk
• GitHub Advanced Security
• Semgrep
• Trivy
• Nessus
• Nmap
• Knowledge of one or more programming languages: Java, Python, C#, JavaScript, TypeScript, Go, PHP, Kotlin, Swift
• Understanding of Object-Oriented Programming (OOP)
• Understanding of Secure Coding Standards
• Understanding of Input Validation
• Understanding of Error Handling
• OWASP Top 10
• SQL Injection (SQLi)
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• Server-Side Request Forgery (SSRF)
• XML External Entity (XXE)
• Insecure Direct Object References (IDOR)
• Remote Code Execution (RCE)
• Command Injection
• Clickjacking
• Content Security Policy (CSP)
• REST API Security
• GraphQL Security
• OAuth 2.0
• OpenID Connect (OIDC)
• JWT
• API Gateway Security
• Rate Limiting
• API Authentication & Authorization