Application Security Engineer (Experienced in applications security focusing on red, blue or purple team activities)
MUFG Investor Services2 months ago
Dublin, IrelandSenior
Responsibilities
- Act as a security champion and promote secure-by-design practices across the business.
- Identify and analyze web application security vulnerabilities across applications, APIs, and infrastructure.
- Manage application security platforms and support coverage, compliance, and remediation of findings.
- Conduct threat modeling and application architecture reviews to identify risks early in the SDLC.
- Implement application security controls and preventative measures.
- Implement and manage SAST and SCA tooling across application repositories.
- Scale automated DAST solutions to increase testing coverage and visibility into runtime security posture.
- Provide security guidance and remediation advice to engineering teams.
- Perform penetration testing of internally developed applications.
- Review third-party vendor applications through configuration and hardening assessments.
- Validate remediation of security issues by development teams and third parties.
- Coordinate external penetration testing assessments.
- Create custom security tooling, scripts, and CI/CD pipeline security jobs.
- Collaborate closely with development, IT, and DevOps teams to resolve security issues.
Requirements
- Experience in application security with red-team, blue-team, or purple-team activities.
- Experience in software development or contributions to open-source projects.
- Experience with DAST tools such as Burp Suite or OWASP ZAP.
- Experience with SAST/SCA tools such as Snyk, Veracode, or Checkmarx.
- Proficiency in one or more of Python, JavaScript, .NET, or Java.
- Knowledge of open-source and third-party library vulnerabilities.
- Strong understanding of the software development lifecycle and agile methodologies.
- Experience testing REST and GraphQL APIs.
- Experience with GitLab or GitHub, Datadog, Jira, Docker, and integrated development environments.
- Experience collaborating with development and DevOps teams on security remediation.
- Experience conducting security-focused code reviews and creating custom security tooling or scripts.
- Preferred experience in financial services or another heavily audited industry.
- Preferred experience with AWS services such as WAF and Cognito, Infrastructure as Code, Kubernetes, containers, OpenID Connect, OAuth, identity providers, and CI/CD pipeline security reviews.
Benefits
- Hybrid work arrangement.
- Connected culture with a focus on innovation and client service.
- Learning and development opportunities.
- Equal opportunity employer.
Tech Stack
Categories