Advanced Software Security Specialist

This role involves a proactive approach to software development security and cloud-native defense.

• Collaborate with development teams to identify vulnerabilities and provide actionable guidance on remediation strategies aligned with business risk.
• Lead threat modeling sessions for critical systems and APIs using STRIDE and PASTA frameworks.
• Design, implement, and oversee automated processes for securely updating application dependencies, mitigating issues proactively and ensuring timely vulnerability remediation.
• Integrate security checks into CI/CD pipelines (SAST, DAST, SCA, IaC) utilizing tools like Semgrep, Snyk, Trivy, and Burp Suite.
• Contribute to runtime security initiatives, such as container/Kubernetes hardening, RASP, and eBPF-based detection.
• Maintain a dashboard to track security issues and metrics.
• Provide real-time support during cybersecurity incidents affecting applications or infrastructure (exploited vuln, credential stuffing, web/API attacks).
• Partner with the Cloud Security team on security automation tasks and monitoring improvements (e.g., Security Hub remediation automations, DLP monitoring).
• Engage in proactive research on new threats, vulnerabilities, and attack techniques relevant to our architecture.
• Collaborate with the GRC team to develop and deliver internal security awareness initiatives and developer training (e.g., secure coding, API security).

Requirements:

• Excellent verbal and written communication skills in English.
• Strong problem-solving and analytical skills.
• Experience in application security, penetration testing roles, and/or secure code development, including work with QA teams.
• Hands-on experience with SAST, DAST, and SCA tools (e.g., Semgrep, Burp, Snyk).
• Deep understanding of web, mobile, and API vulnerabilities (OWASP Top 10, API Top 10, MITRE CWE).
• Proven expertise in performing code reviews and writing clear reports.
• Proficiency in at least one backend language (e.g., Go, Python, Node.js) and knowledge of React/React Native front-ends.
• Familiarity with secure architecture of microservices, event-driven systems, and REST APIs using OAuth2/OpenID Connect.
• Experience securing CI/CD pipelines and integrating AppSec tooling into SDLC.
• Solid knowledge of containerization and Kubernetes security fundamentals.
• Understanding of cloud security (preferably AWS), including IAM principles, cloud-native service configurations, and network segmentation.
• Comfortable working in Agile development methodologies and cross-functional squads.
• Software supply chain security (e.g., SBOM, artifact signing).