Application Security

Job description

<p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Organisation Unit Purpose (why does the unit exist?

What are the results the unit is expected to deliver?)</b></span></span></span></p> <ul> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The unit's primary purpose is to Design, Engineer & eventually Embed practical & balanced cyber / information security principles/patterns/controls into all products and platforms.

Conduct security assessments, gap analysis, provide remediation to the relevant squads / stakeholders.</span></span></span></li>
</ul> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Job Purpose (Why does the job exist?

What is the unique contribution made by the job holder?)</b></span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Primary/General Job Purpose:</b></span></span></span></p> <ul> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Encourage 'Shift Left' Mindset - Proactively embed security requirements, by influencing implementation of security & privacy patterns from the start of the development cycle</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Implement via Influence - Influence stakeholders such as Product Owners, Solution Architects, Developers, Testers, Engineers & others to include security patterns into features, epics and stories in order to build secure, innovative & superior digital products for customers and employees</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Assessments – Perform security assessment and perform gap analysis to provide appropriate remediations to the teams for implementing the fixes.</span></span></span> <ul style="list-style-type:circle"> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Key Skills – Web Application Security, Security Code review, API security, Underlying infrastructure security, Integration Security, Database Security, Secure Configuration Review.</b></span></span></span></li> </ul> </li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Tools and Technologies – Burp Suite, Postman, Tenable Nessus, Checkmarx SAST, GitHub and good knowledge about monolithic and microservice architecture and pipeline driven security.</span></span></span></li>
</ul> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Experience with following Components:</b></span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Technical Requirements</b></span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Application Security - Assessment Skillset</b></span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">1.

Web Application Security – Owasp top 10 , CVSS etc</span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">2.

Security Code Review – manual code review in Git etc</span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">3.

API Security Review – Open shift, container review etc.</span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">4.

Database Security – Requirements to enhance security on Database</span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">5.

Web Server Security – Requirements to enhance security on the web server</span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">6.

Configuration Review – has performed different configuration reviews and should have found good misconfigurations in the system.</span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">7.

Integration review – How the application connects with different systems, performed security review on those integrations.</span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">8.

Transport Layer Security – How communication channels are secured and understanding of the Transport layer security mechanisms and controls.</span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Soft Skills:</b></span></span></span></p> <ul> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Ability to collaborate with multiple stakeholders and manage their expectations from a security perspective</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Holistic thinking; must balance security and functionality using practical demonstrable examples.

Must also contribute to and implement "good architecture principles" to lower technical debt</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Assertive personality; should be able to hold her/his own in a project board or work group setting</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Superlative written and verbal communication skills; should be able to explain technical observations in an easy-to-understand manner</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Ability to work under pressure and meet tough/challenging deadlines</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Influencer- must be able to convince various stakeholders (internal IT Teams, C-Level execs,</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Risk & Audit) of why a certain observation is a concern or not</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Strong understanding of Risk Management Framework and security controls implementation from an implementer standpoint</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Has strong decision making, planning and time management skills.</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Can work independently.</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Has a positive and constructive attitude.</span></span></span></li>
</ul> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Education</b></span></span></span></p> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Bachelor's degree in a computer-related field such as computer science, cyber/information security discipline, physics, mathematics or similar <b>(Essential)</b></span></span></span></p> <ul> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">General Information Security: OSCP, CEH, CISM/CISA or similar </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">General Cloud Security: CCSK /CCSP or similar </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Specific Cloud Security: Azure Security or similar </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Network Security: CCNA, CCNP, CCIE, Certified Kubernetes Security Specialist </span></span></span></li>
</ul> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Experience (Essential)</b></span></span></span></p> <ul> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Must have minimum 3 years of experience in an information security function with good background in information technology, stakeholder management and people management </span></span></span></li>
</ul> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Knowledge & Skills - Technical, Functional & Managerial</b></span></span></span></p> <ul> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Expert at the Web Application Security testing, in depth testing skillset and ability to bypass weak implementation for attacks, ability to bypass WAF for attack scenarios such as XSS, SQL Injection etc.

<b>(Essential)</b></span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Good understanding of Microservice based architecture (Technical) <b>(Essential)</b></span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Good hands-on experience solutioning technology architectures that involve perimeter protection, core protection and end-point protection/detection & API /Micro services Security <b>(Essential)</b></span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Experience working in a DevOps environment with knowledge of Continuous Integration, Containers, DAST/SAST tools and building Evil Stories (Technical) <b>(Essential)</b></span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer should be able to understand how different systems work and what security controls are implemented in such integrations.

<b>(Essential)</b></span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer should be capable in understanding the hardening standards, creating one if not available, and perform the testing against the hardening standards.

<b>(Essential)</b></span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer should be capable of assessing security flaws in underlying infrastructure and the connected components.

<b>(Essential)</b></span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer should be capable of assessing the security flaws in the Transport Layer.

<b>(Essential)</b></span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer has the skill to follow design principles and applies design patterns to enforce maintainable and reusable patterns, in the form of code or otherwise.

</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer can understand and interpret potential issues found in source or compiled code</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer has automation skills/capability in the form of scripting or similar </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer can attack application and infrastructure assets, interpret threats, and suggest mitigating measures</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Ability to interpret Security Requirements mandated by oversight functions and ensure comprehensive coverage of those requirements, via documentation, within high level design and/or during agile ceremonies, via Evil Stories Desirable </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer can propose options for solutions to the security requirements / patterns that provide a balance of security, user experience & performance Desirable </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer has the skill to discuss and present solutions to other architecture, security, development, and leadership teams.

Desirable </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">The Analyst / Engineer can interpret and understand vulnerability assessment reports and calculate inherent and/or residual risks based on the assessment of such reports </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Ability to articulate and be a persuasive leader who can serve as an effective member of the senior management team.

</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Good negotiation skills will be desirable Desirable </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Must have good judgment skills to decide on an exception approval </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Ability to enforce improvements when necessary, using Influence rather than Policing measures Superior written and verbal communication skills to effectively communicate security threats and recommendations to technical or non-technical stakeholders </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Knowledge of application of Agile methodologies/principles such as Scrum or Kanban</span></span></span></li>
</ul> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Behavioral Competencies - Thinking Related, People Related & Self Related (All Essential)</b></span></span></span></p> <ul> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Influencer/Security Evangelist for the Team/Squad</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Positive & Constructive Attitude</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Autonomous worker / Decision Maker</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Good listener </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Patient & Calm during stressful situations </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">High energy individual / Motivator </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Win-Win Attitude </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Hacker/Defense-In-Depth mindset </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Analytical thinking </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Team Player/Interpersonal Skills </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Eye for detail </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Persistent & Persuasive</span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Organized / Structured </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Deadline oriented </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Competent and committed </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">People's Person; understands stakeholder management </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Empathetic </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Passionate about architecting smart solutions </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Innovator/Out of the box thinker </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Collaborative Leadership style </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Confident Presenter All Essential</span></span></span></li>
</ul> <p><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt"><b>Other Information</b></span></span></span></p> <ul> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Age – No bar </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Nationality – No bar </span></span></span></li> <li style="margin-left:8px"><span style="font-family:Verdana,Geneva,sans-serif;"><span style="font-size:12px;"><span style="line-height:12.0pt">Gender – No bar</span></span></span></li>
</ul>

Required Skill Profession

Computer Occupations