IT Security Auditor

UniQtal Solutions LLC; Dimondale (MI); On-site; USD 110,000 - 160,000; Full time

Job summary

UniQtal Solutions LLC in Michigan seeks a Senior Full-Stack Application Development Security Auditor to join onsite near Dimondale, focusing on building secure platforms and applications through dynamic, static and software composition assessments.

The ideal candidate will work with development teams to implement secure coding practices, explain OWASP Top 10 vulnerabilities, and drive security patterns with automation for continuous compliance.

Qualifications

• Experience with application security scanning tools (SAST/DAST/CSA/Container/Cloud).
• HTTP requests/responses headers for web and RESTful API calls.
• Ability to explain OWASP Top 10 vulnerabilities in detail.
• Cross-site scripting, SSRF, CSRF, XML external entities.
• Minimum 5+ years total IT experience.
• Implementing security guidance and secure coding practices (OWASP Top 10, SANS/CERT, CIS Top 25, CSA SafeCode) (3+ years).
• Experience with diverse stacks: Angular, React, Node.js, Java/SpringBoot, IBM WebSphere, Oracle/JBoss, .NET (3+ years).
• Networking infrastructure security and secure development and security automation (DevSecOps).
• Hands-on knowledge building and deploying secure distributed web and mobile apps (3+ years).
• Chrome/Firefox/Edge dev tools to see the request/response headers.

Responsibilities

• Senior Full-Stack Application Development Security Auditor focused on secure platforms via dynamic/static/softw. composition analysis.
• This role works with software development teams, not a SOC, to embed secure coding practices.
• Collaborate with front-end, back-end and cloud application developers.
• Partner with distributed teams to transform systems into securely operated, compliant solutions.
• Lead efforts to implement security patterns with orchestration and automation tools for verification, compliance, and authorization.
• Mature the organization's secure software development practices.

Skills

SAST/DAST

HTTP headers

OWASP Top10

XSS/CSRF/SSRF

5+ years IT exp

Secure coding practices

Front-end/back-end stacks

DevSecOps

Web/mobile apps security

Header tooling

Tools

Coverity

Black Duck

Fortify

APISecurity

JWT

OAUTH/OIDC/PKCE

Containers

Cloud (Azure/AWS/GCP)

Job description

Local candidates only: Candidates must be located within 90-100 miles of Dimondale, MI at the time of submission and must be available for an in-person interview. Per Rose International policy, all submitted candidates must be direct W-2 employees of your company; layered subcontractors are not accepted.

Position Description

*OnlyqualifiedITSecurityAuditorcandidateslocatedneartheDimondaleMIareatobeconsideredduetothepositionrequiringanonsitepresence *

REQUIREDEXPERIENCEKNOWLEDGEABILITIESANDSKILLS:

• ExperiencewithApplicationSecurityscanningtools(SASTDASTSCAASOCContainer/Cloud)amust
• HTTPRequest/ResponseheadersforwebandRestfulAPIcalls
• AbilitytoexplainindetailanyoftheOWASPtop10vulnerabilities
• CrossSiteScriptingInjectionattacksSSRFCSRFXMLentityetc
• Minimumof5+yearsoftotalITrelatedexperience
• Implementing/utilizingFederalIndustryandOpen-SourceSecurityGuidanceandSecureCodingPractices(OWASPTop10SANSCERTCWETop25CriticalSecurityControlsCloudSecurityAllianceSafeCodeetc)(3+years)
• BothcompiledandinterpretedlanguagessuchasAngularReactNodejsJavaSpringBootIBMWebSphereAppserverOracleJBossNETstacks(3+years)
• Networkinginfrastructuresecureapplicationdevelopmentandsecurityautomation(DevSecOps)(3+years)
• Hands-onknowledgebuildinganddeployingsecurecomplexdistributedwebandmobileapplications(3+years)
• Chrome/Firefox/EdgeDevelopmenttoolstoseetherequest/responseheaders

PREFERREDEXPERIENCEKNOWLEDGEABILITIESANDSKILLS:

• ExperiencewithCoverityBlackDuckSRMFortifyaplus
• APISecurity
• JWT
• OAUTH/OIDC/PKCE
• WebAPIreplayattacks
• High-levelunderstandingofcontainers
• Clouddevelopmentexperience(AzureAWSGCP)

JOBRESPONSIBILITIES:

• SeniorFullStackApplicationDevelopmentSecurityAuditorwhoispassionateaboutdesigningandbuildingsecureplatformsandapplicationsthroughDynamicStaticandSoftwareCompositionAnalysisassessments
• ThispositionisnotamemberoftheSecurityOperationsCenterratheritisdedicatedtoworkingwithsoftwaredevelopmentteamsonsecurecodingpractices
• Theidealcandidatewillfeelcomfortableworkingwithbothfront-endback-endandcloud-basedapplicationdevelopers
• Partneringwithdistributedteamstohelptransformthewaysystemsarebuiltsecuredauthorizedandsecurelyoperatedforcontinuouscomplianceandriskmitigation
• Specificallythiscandidatewillhelpleadeffortstoimplementsecuritypatternsandpracticeswithorchestrationandautomationtoolsthatautomatethesecureconfigurationverificationcomplianceandauthorizationofsystemsandtheirdevelopment
• Theywillbeakeymemberofateamtaskedwithmaturingtheorganization'ssecuresoftwaredevelopmentpractices