Engineer Application Security, Cybersecurity

Summary

This position will help implement and validate the security controls on worldwide applications and will support the Application Security Practice and Dev Sec Ops. The Application Security Engineer will contribute to the implementation, evaluation, and definition of new security standards and processes with company's application properties. This position will also assist in documenting and tracking application security policies, processes, procedures, standards, and controls. This position will apply secure application development best practices and provide support for security analysis and enforcement of defenses and countermeasures at each phase of the software development lifecycle, resulting in high-quality, robust, and reliable software.

Responsibilities/ Duties:

• Oversee day-to-day activities related to the application security management system and the application security pipeline, including vulnerability management and code review.
• Integrate security tools, standards, and processes into the Software Development Life Cycle (SDLC).
• Ensure application teams and QA personnel are trained with the appropriate level of security knowledge to perform their daily activities.
• Improve and support application security tool deployments, including static, dynamic analysis, runtime testing, and SCA tools.
• Support the incident response and architecture review processes whenever application security expertise is needed.
• Manage annual penetration testing services, including both expert consulting and managed services.
• Define and enforce the vulnerability management process, including vulnerability assessments and penetration tests, as well as a continuous improvement process.
• Support application security projects and vendor security activities to ensure third-party software and development meet Herbalife security standards.
• Integrate threat modelling and Secure SDLC practices into the application development lifecycle.
• Provide security requirements for test-driven application design.
• Collaborate with other departments on their daily security requirements.
• Work closely with company's development teams to provide guidance on proper application security best practices and standards.
• Support internal and external contractual, regulatory, and legal compliance relevant to application security.
• Be available 24x7 for incident response and end-of-month support.

Supervisory Responsibilities:

• Manage vendor subject matter experts (if applicable )

Qualifications Skills:

• Knowledge of Secure SDLC best practices and familiar with implementation of application security controls.
• Understanding of relevant application security vulnerabilities including OWASP Top 10, best practices, and testing methodologies.
• Experience in penetration testing (Web, API, and Mobile Application) along with programming/scripting skills will be an advantage.
• Familiarity with code review for Java, .Net and .Net Core, etc.
• Ability to respond immediately to application security-related incidents and perform post-event analysis.
• Adequate knowledge of web-related technologies (Web applications, Web Services, and Service-Oriented Architectures, API integration) and network/webrelated protocols.
• Adequate knowledge of OS, Networks, Cryptography, Databases, Web Technologies.
• Knowledge of Application security tools such as Burp Suite, Kali Linux, Metasploit, etc.
• General knowledge of build pipelines and CI/CD.
• Ability and willingness to learn new skills quickly.
• Flexibility to work in an agile and fluid environment.
• Effective written and verbal communication skills.
• Strong collaboration abilities and good communication skills.
• Good oral and written communication skills in English.

Experience:

• Related experience in the Application Cybersecurity, IT Security field, and application development operations.
• Embedded Application information management systems into the application development lifecycle.
• 3-5 years of penetration testing experience for web applications, mobile apps, etc.
• Experience with Application security protection and testing tools such as DAST, IAST, SAST, MAST, RASP, WAF.
• Familiarity with one of the programming languages and development tools in either of the following technology stacks: 1. JAVA-related development skills, framework, e.g., Java Spring MVC, Spring Cloud. 2. Windows Development APIs including C#, .NET framework, .NET Core.

Education:

• Bachelor’s degree in Computer Science, Information Technology, Business or equivalent discipline (OR) 3-5 years related experience and/or training; or equivalent combination of higher education and experience
• Technical Certifications such as OSCP, CISSP, CSWAE is preferred