1 day ago
Responsibilities
- Own and continuously improve the application attack surface management program across internet-facing applications, APIs, mobile applications, and cloud assets.
- Perform and oversee SAST, DAST, SCA, manual source code reviews, API security assessments, threat modeling, and application penetration testing.
- Conduct Android and iOS security testing, including reverse engineering, runtime instrumentation, certificate pinning bypass, and insecure storage analysis.
- Assess infrastructure as code, containerized workloads, Kubernetes configurations, registries, runtimes, and software supply chains for security risks.
- Define and maintain encryption, cryptography, application security, and secure SDLC policies and standards.
- Assess AI- and LLM-enabled applications for prompt injection, data leakage, model abuse, and insecure output handling.
- Support PCI DSS compliance, audits, evidence collection, and payment page script integrity requirements.
- Partner with development, DevOps, cloud, and product teams to communicate risk, validate fixes, and embed security into development processes.
- Mentor junior team members, contribute to security tooling and automation, and represent application security in architecture and design reviews.
Requirements
- 9+ years of experience in software development and application security, including at least 5 years of hands-on experience with SAST, DAST, SCA, API security, secure code review, threat modeling, and container security.
- Experience with application, API, and mobile security assessment tools including Burp Suite Professional, Checkmarx, OWASP ZAP, Postman, AppScan, WebInspect, Fortify, Veracode, or Semgrep.
- Hands-on Android and iOS penetration testing experience with tools such as MobSF, Frida, Objection, Jadx, apktool, Hopper, Ghidra, Xcode, and Android Studio, plus knowledge of OWASP MASVS and MASTG.
- Strong manual source code review skills in at least two major programming languages and the ability to identify complex and logic-based vulnerabilities.
- Expert knowledge of the OWASP Top 10, OWASP API Security Top 10, SANS/CWE Top 25, and common attack techniques.
- Experience securing infrastructure as code and container environments with tools such as Checkov, tfsec, KICS, Trivy, Grype, Snyk Container, or Prisma Cloud, along with Docker and Kubernetes knowledge.
- Knowledge of cryptography, encryption standards, key management, PKI, TLS, secure secrets handling, and encryption policy development or review.
- Experience integrating security testing into CI/CD pipelines using Jenkins, GitHub Actions, GitLab CI, or Azure DevOps.
- Working knowledge of PCI DSS requirements for secure software development and application security.
- Preferred qualifications include experience with Black Duck, Snyk, Dependency-Track, SBOM standards, AI/LLM application security, attack surface management platforms, AWS, Azure, GCP, OPA/Rego, Sentinel, reverse engineering, identity and access management, and regulated environments.
- Relevant certifications such as OSCP, OSWE, GWAPT, GMOB, eMAPT, CSSLP, CISSP, or CKS are preferred.
- Excellent communication skills and the ability to explain technical risk to engineers, leadership, and clients.
Benefits
- Modern international work environment with a dedicated and motivated team.
- Professional education and personal development opportunities.
- Opportunity to work on challenging financial services and technology issues.
- Collaborative, flexible, and respectful work environment.
- Varied work supporting growth in product, functional, domain, and leadership skills.
Tech Stack
AnsibleAWSAzureC#COBOLDockerGitHub ActionsGitLab CI/CDGoGoogle Cloud PlatformGraphQLgRPCHelmJavaJavaScriptJenkinsKotlinKubernetes.NETPostmanPythonSOAPSwiftTerraformTypeScript
Categories
About FIS
FIS builds financial technology for banks, merchants, and capital-markets firms, including core banking platforms, payment processing, fraud/risk tools, and investment/treasury systems. It sells enterprise software, cloud services, and outsourced processing via long-term contracts and transaction-based fees. Founded in 1968 and headquartered in Jacksonville, Florida, FIS is a Fortune 500 public company trading on the NYSE (FIS) with customers worldwide.