Overview:

Required Skills

Experience with Application Security scanning tools (SAST, DAST, SCA, ASOC, Container/Cloud) a must.

HTTP Request/Response headers for web and Restful API calls

Ability to explain in detail any of the OWASP top 10 vulnerabilities

Cross Site Scripting, Injection attacks, SSRF, CSRF, XML entity, etc.

Minimum of 5+ years of total IT related experience

3+ years implementing/utilizing Federal, Industry and Open-Source Security Guidance and Secure Coding Practices (OWASP Top 10, SANS, CERT, CWE Top 25, Critical Security Controls, Cloud Security Alliance, SafeCode etc.)

3+ years with both compiled and interpreted languages such as Angular, React, Node.js, Java, Spring Boot, IBM WebSphere App server, Oracle JBoss, .NET stacks

3+ years with networking, infrastructure, secure application development and security automation (DevSecOps).

3+ years of hands-on knowledge building and deploying secure complex distributed web and mobile applications.

Chrome/Firefox/Edge Development tools to see the request/response headers

Preferred Skills

Experience with Coverity, BlackDuck, SRM, Fortify a plus

API Security

JWT

OAUTH/OIDC/PKCE

Web, API replay attacks

High-level understanding of containers

Cloud development experience (Azure, AWS, GCP)

Skills:

years with both compiled and interpreted languages such as Angular, React, Node.js, Java, Spring Boot, IBM WebSphere App server, Oracle JBoss, .NET stacks