• 
  Jobseeker Video Testimonials
• 
  Employee Glassdoor Reviews

We are an IT Solutions Integrator/Consulting Firm helping our clients hire the right professional for an exciting long-term project. Here are a few details.

Requirements

We are seeking an
experienced Consultant with deep expertise in Application Security Testing to
join our growing team. The ideal candidate brings hands-on mastery of Static
Application Security Testing (SAST) and Dynamic Application Security Testing
(DAST), paired with strong vulnerability triage and remediation-guidance
skills. This role requires a technically versatile security engineer who can
scan, analyze, and validate findings across the full application security
lifecycle - from source code analysis to runtime testing - while contributing
to tool configuration, false-positive triage, and secure development practices,
and collaborating effectively with cross-functional teams in a fast-paced
consulting environment.

•
Partner with client and internal teams to
gather, analyze, and translate application security requirements into robust
SAST and DAST testing plans.

•
Configure, execute, and maintain SAST scans
using tools such as Checkmarx or Fortify across enterprise codebases.

•
Configure, execute, and maintain DAST scans
using tools such as HCL AppScan and Burp Suite, against web applications and
APIs.

•
Triage scan findings to distinguish true
positives from false positives, and provide developers with clear, actionable
remediation guidance.

•
Support application onboarding into scan
tooling, manage scan scheduling, and maintain scan coverage across the
application portfolio.

•
Validate remediated vulnerabilities and drive
findings through to closure in the Vulnerability Information Tracker
or equivalent defect-tracking system.

•
Collaborate with development, DevOps, and
platform engineering teams to embed security testing within CI/CD pipelines.

•
Analyze vulnerability trends across OWASP Top 10
categories and recommend systemic fixes to reduce recurring findings.

•
Document scan configurations, triage decisions,
and remediation guidance clearly and consistently.

•
Troubleshoot scan failures, tool connectivity
issues, and environment-specific scanning challenges.

•
Contribute to reusable secure-coding patterns,
scanning standards, and best practices for application security testing.

•
Support release-gating and production-release
security reviews, including exception and risk-acceptance workflows.

•
Mentor junior security analysts and support
knowledge transfer across the application security testing team.

SAST & Static Code Analysis

•
Static Application Security Testing (SAST) —
Mastery: Proven experience configuring and running static code analysis tools
(Checkmarx, Fortify, SonarQube, or equivalent) across multiple languages and
frameworks.

•
Strong understanding of secure coding
principles, common code-level vulnerability patterns, and remediation
techniques.

•
Ability to tune SAST rulesets and scan policies
to reduce noise while maintaining detection coverage.

•
Experience integrating SAST scans into build
pipelines and interpreting scan results at scale.

DAST & Dynamic Testing

•
Dynamic Application Security Testing (DAST) —
Mastery: Hands-on expertise running dynamic scans against web applications and
APIs using tools such as HCL AppScan, Burp Suite, or OWASP ZAP.

•
Working knowledge of authenticated scanning,
session handling, and crawling configuration for complex applications.

•
Familiarity with API security testing, including
REST and SOAP endpoints, and common API-specific vulnerability classes.

•
Experience validating dynamic findings against
application behavior to confirm exploitability.

Vulnerability Management &
Triage

•
Strong grounding in the OWASP Top 10 and related
vulnerability taxonomies (Broken Access Control, Injection, Security
Misconfiguration, Sensitive Data Exposure, and others).

•
Experience with false-positive analysis and
root-cause triage across SAST, DAST, and software composition analysis (SCA)
findings.

•
Familiarity with Vulnerability Information
Tracker (VIT) workflows: creation, validation, and closure of defects.

•
Understanding of risk-rating methodologies (CVSS
or equivalent) to prioritize remediation effort.

Tooling & Integration

•
Experience with software composition analysis
(SCA) and secret-scanning tools (e.g., Checkmarx SCA, Cycode, or equivalent).

•
Familiarity with CI/CD platforms (Azure DevOps,
GitHub Actions, GitLab CI/CD) and embedding security scans within pipelines.

•
Exposure to cloud security posture and
configuration scanning tools (e.g., Prisma Cloud) is a plus.

•
Basic scripting ability (PowerShell, Python, or
Bash) to support scan automation and reporting.

Collaboration & Communication

•
Ability to work effectively with
cross-functional teams including developers, architects, DevOps, and platform
engineering.

•
Strong problem-solving, analytical, and
written/verbal communication skills.

•
Ability to document scan findings, remediation
guidance, and risk decisions clearly and concisely.

•
Experience in client-facing roles with
demonstrated ability to present security findings to non-technical
stakeholders.

•
Experience delivering application security
testing services in a consulting or professional services environment.

•
Familiarity with cloud platforms such as
Microsoft Azure, AWS, or GCP, including native security tooling and
configuration scanning.

•
Experience supporting multi-environment
deployment processes including development, QA, UAT, and production releases.

•
Exposure to penetration testing, security header
validation, and automated security testing frameworks.

•
Understanding of secure SDLC practices,
enterprise security standards, and regulatory compliance considerations (HIPAA,
PCI-DSS, or equivalent).

•
Experience with agile/scrum delivery
methodologies, sprint planning, and backlog management.

•
Familiarity with tool-outage support procedures
and SOP-based incident response for scanning platforms.