A
obmazatsya with certifications👍
Оставляйте резюме на рабочем столе у hr@softseq.com , вылизывать их не обязательно, нам важны скилы а не бумажки. Ну и форвардните толковым знакомым, плес - много людей ищем же :)
1. Application security engineer, up to $5000/month (negotiable), 40h/week, Kyiv—————————————————————
What to do?
- help design Secure SDLC in a mixed waterfall/agile environment (OWASP SAMM)
- hands-on perform specialist appsec processes in SDLC (design review, Java code review, testing, etc)
- help properly set up automation in CI/CD (so HP Fortify / HP WebInspect suck less)
- basic performance testing to ensure system's Availability (optional)
- lead an appsec team that will be built by you and around you
What to know?
- all parts of Secure SDLC - Governance, Design, Implementation, Verification, and Operations. Understand and communicate well the processes that minimize software vulnerabilities, be able to give specific examples and realistic how-to's
- web app security, in-depth and hands-on
- English - upper-upper-intermediate+ or advanced, customer team is all foreign
What's the project?
- multiple web apps, predominantly Java
- Saudi government agency - NOT defense/intelligence, public web apps
2.1. Application security engineer x2, $3000 guaranteed base + up to $3000 for utilization + bug bounties, 40h/week, Kyiv
2.2. Application security engineer x2, $2000 guaranteed base + up to $2000 for utilization + bug bounties, 40h/week, Kyiv
What to do?
- 20h/week guaranteed base - for a US insurance software company, perform hands-on specialist appsec processes in SDLC (design review, Java code review, testing, etc)
- 20h/week contract-dependent utilization - web and mobile app security audits for SoftSeq customers, sometimes IoT
What to do when there's no contract-dependent utilization (project gap)?
- CTF-team/hackaton-style organized pwning of bug-bounties - for PR (SoftSeq) and profit (all bounties are yours)
- Project Zero-style research of trending startups, popular apps, network and IoT devices, attack techniques, etc.
- developing PoCs of security tools/products that don't exist, but should
- obmazatsya with certifications
- +open to monetizable or commercially benefiting suggestions (1-day patch diffing, malware analysis, etc. - you name it)
What to know?
- web app security, in-depth and hands-on (must)
- Android/iOS reverse engineering (highly desirable)
- x86/ARM reverse engineering (desirable)
- languages - English and python, upper-intermediate
