Application Security Engineer, Synthesia

• You have a passion for security engineering and you want to share this passion with as many like-minded colleagues as possible. You have worked for 2-3 years in an Information Security team, or you have championed security within engineering teams, you a proponent of DevSecOps and you want to deal with interesting problems
• Web application security principles and have worked hands-on with the OWASP Top 10, the OWASP ASVS or the CWE Top 25
• Working with a Secure Development Lifecycle model (e.g. OpenSAMM, BSIMM)
• Software development (we use Python and TypeScript, running on Docker)
• Working with vulnerability assessment / management tools (e.g. Wiz, Snyk, SynAck)
• Working within the context of an Information Security framework (e.g. ISO 27001, SOC 2, PCI DSS)
• Working with security in the cloud (we are on AWS)
• Working with Github

Desirable

• Responsibilities include building a scalable security presence within development teams by establishing an Application Security Champions program, facilitating the integration of security tools with the development pipeline, making them self-service for engineering teams, running and scaling security activities such as threat modeling, code scanning, web app scanning, threat detection, and architectural and code reviews
• Additionally, you will provide subject matter expertise on topics such as secure design, security controls, programming practices, encryption, and web security standards
• You will lead vulnerability management and exposure assessments when vulnerabilities are discovered and ideally, even fix vulnerabilities yourself
• You will also implement or assist in the implementation of security-related product features