Application Security Engineer

Summary

Join GuidePoint Security as a Security Engineer and leverage your expertise in SAST tools like Snyk to enhance our clients' security posture. You will play a key role in implementing, operationalizing, and troubleshooting SAST tools within CI/CD pipelines. Your software engineering background and understanding of application security fundamentals will be crucial. You will collaborate with a team of skilled professionals, contributing to the development and improvement of our security tools and processes. This role offers a remote work environment and a comprehensive benefits package, including health insurance, paid time off, and retirement plan eligibility.

Requirements

• Proficiency with the implementation, operationalization, and troubleshooting of Snyk’s Static Application Security Testing (SAST) tool
• Understanding of Continuous Integration / Continuous Delivery (CI/CD) pipeline tools and processes (e.g. GitHub Actions, GitLab Runners, Azure DevOps, Jenkins, CircleCI, etc.)
• Experience in software engineering, ideally full stack software development, including modern technologies and application architectures
• Strong scripting and automation experience using one or more programming languages
• Solid working knowledge of application security fundamentals including the OWASP Top 10, threat modeling, and implementing secure coding practices throughout the Software Development Lifecycle (SDLC)
• Excellent written and verbal communication skills
• Bachelor’s degree in a relevant discipline or equivalent experience
• 3-5 years of security engineering experience in the Information Security industry

Preferred Qualifications

• Proficiency with the implementation, operationalization, and troubleshooting of other Static Application Security Testing (SAST) tools such as Semgrep, CodeQL, Checkmarx, Veracode, etc
• Experience writing or adapting custom SAST rules (Semgrep or CodeQL)
• Familiarity with additional Application Security tools (e.g. Interactive (IAST), Dynamic (DAST) and API security, SCA, etc.)
• Familiarity with API Security tools (e.g., NoName, Traceable, Salt, Cequence)
• Practical hands-on experience validating vulnerabilities and proficiency with Burp Suite
• Strong working knowledge of Secure Development Lifecycles and experience triaging and remediating technical vulnerabilities identified by web application scanning tools
• Understanding of automated security testing approaches and tools
• Experience in building and operating security tools within CI/CD pipelines
• Experience with proactive integration of security into the development process
• Past experience as an application security practitioner or software engineer

Benefits

• Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions)
• Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans (spouse/children/family) or High Deductible Health Plan with HSA (GuidePoint pays 100% of the employees premiums and 75% for family plans (spouse/children/family) and GPS will contribute in one lump sum: ($500 per EE annually / $1000 per family annually (includes spouse/children/family options)
• Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans
• 12 corporate holidays and a Flexible Time Off (FTO) program
• Healthy mobile phone and home internet allowance
• Eligibility for retirement plan after 2 months at open enrollment
• Pet Benefit Option