Senior Application Security Engineer, CrowdStrike

• Self-motivated to identify security defects and engage with engineering teams to find solutions
• A deep understanding of how software products are created and shipped in Agile/DevOps like environments
• Experience with threat model framework(s), especially using STRIDE
• Proven experience in manual secure code review for apps built with Go (Golang), Python, or JavaScript (emphasis on browser-side)
• Demonstrable proficiency in hands-on review and testing of API endpoint security
• A working knowledge of secure configuration of cloud-native and containerized apps in multiple Cloud environments (GCP, Azure, AWS)
• Experience using and/or maintaining commercially available AppSec tools like SAST, DAST, CSPM, DSPM, and ASPM suites
• A solid understanding of common software weaknesses that impact cloud and web applications (not just the OWASP Top 10) and demonstrable experience in application penetration testing
• Examples of collaborating across technical teams: asking technical questions, challenging assumptions, getting or providing context for decisions, etc
• Demonstrable experience developing/maintaining automation for application security tasks and defect identification
• Technical security certifications or academic background are a plus

Desirable

• As a Senior Application Security Engineer you will dig deep into web applications, find design and implementation flaws, help our product engineers fix defects, and play a role in shipping secure code.
• You’ll be actively involved in fixing defects rather than just reporting them and hoping for the best.
• Additionally, you will be integral to cross-cutting projects to further harden internal systems and processes against active and emerging threats
• Join engineering teams working on applications as a security expert and advisor, influencing the design and capabilities of our products
• Create, maintain, and mature threat models to drive security architecture review and eliminate threat surface area
• Review application source code, looking for security defects and risk
• Attack applications throughout the Secure Development LifeCycle
• Work with developers to help them understand defects, risks, design weaknesses, etc. and implement proven solutions
• Build integrated tools and automation to make life easier for you, your team, and our engineering partners
• Drive response efforts to our bug bounty program, hunt for similar issues across the platform, and improve the security of our applications