Application Security Expert

Do you like to conduct application penetration testing and identify vulnerabilities?  Would you like to proactively perform threat modeling for new and existing applications?

• Application Penetration Testing: You will perform manual and automated application penetration testing against web applications,  APIs and mobile applications to identify vulnerabilities, business logic flaws and chained attack vectors
• Threat Modeling: You will lead threat modeling sessions, using methodologies like STRIDE and PASTA to identify, analyze and prioritize threats in application architectures
• Security Assessments: You will conduct comprehensive application architecture, source code reviews and vulnerability assessments to validate security controls
• Remediation Guidance: You will collaborate with developers and product teams to explain complex vulnerabilities, provide actionable remediation guidance and verify security fixes
• Detection Engineering: You will provide our Detection Engineering team with propositions for the development of detection logic to increase coverage of our application security monitoring practice
• Tooling: You will leverage penetration testing tools (Burp Suite Pro, OWASP ZAP, …) and develop scripts (Python, Bash, …) to automate testing tasks and improve efficiency. You will develop data flow diagrams (MS Threat Modeling Tool, OWASP Threat Dragon, …) and research new application security solutions to add to our toolkit.

• You have at least 3+ years of recent hands-on experience in application penetration testing and threat modeling
• You have proven experience in conducting and facilitating threat modeling workshops and integrating threat modeling into the SDLC
• You have a deep understanding of OWASP ASVS, web/mobile app security and cloud security architectures (AWS, Azure and GCP) as well as threat modeling methodologies like STRIDE, PASTA, …
• You have a degree in Computer Sciences, Information Security or equivalent by experience
• Certifications like GWAPT, GXPN, GMOB, Burp Suite Certified Practitioner, OSWA, OSWE, … are highly appreciated
• You have excellent written and verbal communication skills in English and preferably Dutch
• You are able to coordinate penetration testing and threat modeling assignments, as well as translating complex technical findings into actionable reports for stakeholders
• You work collaboratively with cross-functional teams (developers, application owners, managers, …) in a fast-paced environment.