IT Security Auditor

Local candidates only: Candidates must be located within 90-100 miles of Dimondale MI at the time of submission and must be available for an in-person interview. Per Rose International policy all submitted candidates must be direct W-2 employees of your company; layered subcontractors are not accepted.

Position Description

***OnlyqualifiedITSecurityAuditorcandidateslocatedneartheDimondaleMIareatobeconsideredduetothepositionrequiringanonsitepresence***

REQUIREDEXPERIENCEKNOWLEDGEABILITIESANDSKILLS:
ExperiencewithApplicationSecurityscanningtools(SASTDASTSCAASOCContainer/Cloud)amust
HTTPRequest/ResponseheadersforwebandRestfulAPIcalls
AbilitytoexplainindetailanyoftheOWASPtop10vulnerabilities
CrossSiteScriptingInjectionattacksSSRFCSRFXMLentityetc
Minimumof5yearsoftotalITrelatedexperience
Implementing/utilizingFederalIndustryandOpen-SourceSecurityGuidanceandSecureCodingPractices(OWASPTop10SANSCERTCWETop25CriticalSecurityControlsCloudSecurityAllianceSafeCodeetc)(3years)
BothcompiledandinterpretedlanguagessuchasAngularReactNodejsJavaSpringBootIBMWebSphereAppserverOracleJBossNETstacks(3years)
Networkinginfrastructuresecureapplicationdevelopmentandsecurityautomation(DevSecOps)(3years)
Hands-onknowledgebuildinganddeployingsecurecomplexdistributedwebandmobileapplications(3years)
Chrome/Firefox/EdgeDevelopmenttoolstoseetherequest/responseheaders

PREFERREDEXPERIENCEKNOWLEDGEABILITIESANDSKILLS:
ExperiencewithCoverityBlackDuckSRMFortifyaplus
APISecurity
JWT
OAUTH/OIDC/PKCE
WebAPIreplayattacks
High-levelunderstandingofcontainers
Clouddevelopmentexperience(AzureAWSGCP)

JOBRESPONSIBILITIES:
SeniorFullStackApplicationDevelopmentSecurityAuditorwhoispassionateaboutdesigningandbuildingsecureplatformsandapplicationsthroughDynamicStaticandSoftwareCompositionAnalysisassessments
ThispositionisnotamemberoftheSecurityOperationsCenterratheritisdedicatedtoworkingwithsoftwaredevelopmentteamsonsecurecodingpractices
Theidealcandidatewillfeelcomfortableworkingwithbothfront-endback-endandcloud-basedapplicationdevelopers
Partneringwithdistributedteamstohelptransformthewaysystemsarebuiltsecuredauthorizedandsecurelyoperatedforcontinuouscomplianceandriskmitigation
Specificallythiscandidatewillhelpleadeffortstoimplementsecuritypatternsandpracticeswithorchestrationandautomationtoolsthatautomatethesecureconfigurationverificationcomplianceandauthorizationofsystemsandtheirdevelopment
Theywillbeakeymemberofateamtaskedwithmaturingtheorganizationssecuresoftwaredevelopmentpractices