Sr. Consultant – Application Security, Threat Management | Remote, USA

This position will be fully remote and can be hired anywhere in the continental U.S.

Optivs Application Security and Threat Management group is a multi-disciplined consulting team with focus areas on network penetration, malware analysis, vulnerability research, hardware testing, operating system, mobile device, and application testing. The Application Security group focuses on mobile and web application testing, and generally anything in Java, .Net, PHPor Web/Mobile frameworks.

The majority of work is remote (some travel required) and can be hired anywhere in the continental U.S.

How youll make an impact

Conduct penetration testing using both black box testing techniques as well as in-depth reviews of source code

Demonstrate a comprehensive application testing methodology. Identify critical vulnerabilities not detectable by static analysis tools and provided reports, severity classifications, and remediation advice

Perform Gray box application testing. Our normal app assessment approach is a full-knowledge gray box style where we have access to docs, source, a functioning app, and control of the environment. We do also perform straight code reviews or black box testing, and all consultants need to be comfortable with both

Our Sr. Consultants know how to approach a large code review and be experienced with current static analysis tools. You should be able to look at a codebase and prioritize code for top-down as well as create signatures for components that aren’t covered with the base toolset. Aid in vulnerability remediation efforts by working alongside developers as well as directly contributing to the code base

Perform mobile application testing to understand the threat classes for mobile apps on the iOS and Android platforms

Secure SDLC consulting for Agile / DevOps

Perform Secure SDLC Assessments; familiarity with SAMM or BSIMM. Threat Modeling and SDL processes, as per the MS guidelines

Perform or lead Threat Modeling efforts for multiple application deployments (on-prem, cloud, mobile)

Provide security recommendations on service design and application development

Create Policies and Standards for application security governance

Leverage SAST, DAST, and penetration testing to identify risks and appropriate mitigations

Leverage SCA and assist with implementing software supply chain security controls and the creation SBOMs

Track known vulnerabilities, their remediation statuses, and remediation metrics

Present application security concerns to leadership for decision making when necessary

Work closely with cross-functional teams (Engineering, DevOps, Product, Operations, SOC)

What were looking for

4 years’ experience in a directly related role required

2 years’ consulting and/or enterprise experience required

Strong understanding of software development lifecycle (SDLC) and development methodologies

Development experience in one or more of these areas: JavaScript; SQL; Java; C#; Python; js; AngularJS; Swift; Objective-C; Net (C#/Net), Java, Ruby, PHP, Python, along with common dev frameworks such as Spring Core/Boot/MVC, Hibernate, JSF/JSP, Ruby On Rails, Sinatra, Entity Framework, WCF

Must be willing to travel 20-40% as required

Things we like to see

CVEs, links to your con presentation (or your con), tools, research papers, generally anything that can demonstrate you know your stuff when it comes to web and mobile applications.

#LI-SM1

What you can expect from Optiv

A company committed to championing Diversity, Equality, and Inclusion through our Employee Resource Groups (http://www.optiv.com/company/about-us#dei-group) .

Work/life balance

Professional training resources

Creative problem-solving and the ability to tackle unique, complex projects

Volunteer Opportunities. “Optiv Chips In” encourages employees to volunteer and engage with their teams and communities.

The ability and technology necessary to productively work remotely/from home (where applicable)

EEO Statement

Optiv is an equal opportunity employer (EEO). All qualified applicants for employment will be considered without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, status as an individual with a disability, veteran status, or any other basis protected by federal, state, or local law.

Optiv respects your privacy. By providing your information through this page or applying for a job at Optiv, you acknowledge that Optiv will collect, use, and process your information, which may include personal information and sensitive personal information, in connection with Optiv’s selection and recruitment activities. For additional details on how Optiv uses and protects your personal information in the application process, click here to view our Applicant Privacy Notice (http://www.optiv.com/job-applicant-privacy-notice) . If you sign up to receive notifications of job postings, you may unsubscribe at any time.