2+ years of webapp and network pentesting experience, with bonus for mobile apps, APIs, and cloud environments
4+ years of professional experience with Ruby on Rails or equivalent, and Vue or a similar frontend framework
Proven experience with Linux and cloud environment testing
Strong understanding of security issues across various infrastructures, including desktop and cloud services
Familiarity with information systems security standards and practices
Experience in assessing advanced persistent threats (APTs) and vulnerability management
Detail-oriented with strong problem-solving skills
Responsibilities
Utilize open-source penetration testing tools and emulate hacker tactics
Generate security vulnerability reports for different audiences
Collaborate with security engineers to find solutions to identified problems
Automate basic tasks to improve penetration testing efficiency
Show eagerness to learn new technologies and improve existing processes
Communicate findings effectively with technical and non-technical stakeholders
Stay informed about the latest zero-day exploits relevant to used tech stacks
Benefits
100% employer-paid medical, dental, and vision insurance
Annual review process with raise options
22 days of Paid Time Off plus 4 holidays, increasing to 29 days after 3 years, with flexible time off after 5 years
Paid parental leave
Up to 6% 401(k) company matching with no vesting period
Quarterly allowance for remote work setup and personal development
Creative and open work environment without trivial benefits
Full Job Description
Overview
We are expanding our team to include a Security Engineer to be 100% focused on our security efforts. As the right candidate, you will have experience working in-house as a full-time penetration tester, a regular 3rd party bug bounty program pen tester, or in a similar security type role. Your job will be to identify our vulnerabilities to help keep our information safe and secure.
Wage
Up to $175,000 / year Benefits
100% employer-paid medical, dental and vision for employees
Annual review with raise option
22 days Paid Time Off accrued annually, and 4 holidays
After 3 years, PTO increases to 29 days. Employees transition to flexible time off after 5 years with the company-not accrued, not capped, take time off when you want
The 4 holidays are: New Year's Day, Fourth of July, Thanksgiving, and Christmas Day
Paid Parental Leave
Up to 6% company matching 401(k) with no vesting period
Quarterly allowance
Use to make your remote work set up more comfortable, for continuing education classes, a plant for your desk, coffee for your coworker, a massage for yourself... really, whatever
Open concept office with friendly coworkers
Creative environment where you can make a difference
No dumb benefits like free dog walking on the weekends that snobby hipster places have to make you feel cool, but mathematically won't cost the company much money because you won't use it
Trail Mix Bar - oh yeah
Responsibilities
Understand and safely use various open source penetration testing tools and when appropriate, emulating hacker tactics, techniques, procedures
Create security vulnerability reports for both technical and executive audiences
While in-between assessments, you will be expected to help our security engineers think through solutions to problems you find
Automate tasks and script at a basic level to enhance penetration testing processes
Passion for learning new technologies and processes, and contributing to refining existing capabilities
Communicate with stakeholders (technical and non-technical), both verbal and written
Stay up to date on 0 day exploits for tech stacks we use
Requirements
Solid fundamentals in webapp and network pentesting (2+ years). Pentesting experience in mobile apps, APIs, and/or cloud environments a bonus
4+ years of professional experience in Ruby on Rails or equivalent and Vue or a Frontend equivalent framework
Experience with Linux and cloud environment testing
Understanding of security issues for desktop, virtual, cloud services and network infrastructures
Working knowledge of information systems security standards/practices (e.g., access control and system hardening, system audit and log file monitoring, security policies, and incident handling)
Experience with secure network protocols and encryption of communications between networked hosts
Experience in IT systems and security policies, standards, industry trends, and techniques
Experience with assessing APT threats, Penetration Testing, Vulnerability Management, attack methodologies, forensics analysis techniques, malware analysis, attack surface comprehension, Cyber Threat Emulation operations, Cyber Advanced Threat Emulation Team operations and research, identification, and/or verification of new APT TTPs
Fundamental understanding of security knowledge of testing mobile, native applications, web applications, distributed and database systems
Must be detail-oriented and possess strong problem-solving skills and ability to analyze for potential future issues
Solid understanding of common webapp vulnerabilities, exploitation techniques, and remediation options
