WiproEmployer profile

Cyber Security Analyst

Location not specified · 5–7 yrs

Experience: 5–7 yrs
Salary: Not disclosed
Location: Location not specified
Work mode: Not specified
Job type: Full-time
Apply by: Closing date not listed
Posted: 15 Jul 22

About this role

ob description

Job Title: Application Security Engineer

About Role

Job Summary

The Application Security Engineer will be in charge of assessing the security of different types of applications developed

by Schlumberger teams or acquired from 3rd party vendors. Work with company development teams or vendors to detect,

prioritize and remediate security flaws within the applications. Collaborate with IT and the business to identify and

implement appropriate software development related security controls.

Key responsibilities

Perform application security assessment for web, cloud, mobile, and thick client applications
Perform different types of application security assessments as needed; this involves application penetration testing,

network penetration testing, attack surface evaluation, threat modelling and security design reviews

Perform web services (APIs) penetration testing and analyze communications between client and servers
Perform manual penetration testing of applications using appropriate tools and techniques to uncover critical security

vulnerabilities in the software, the infrastructure, the configuration and business logic

Check separation of duties and access controls, review accounts management and check SSL certificates
Perform risk analysis and define prevention and mitigation controls for application vulnerabilities
Explain all vulnerabilities and weaknesses in the OWASP Top 10, WASC TCv2, and CWE 25 to application

development teams or application vendor, and discuss effective defensive techniques

Provide mitigation strategies for applications from infrastructure, architecture and secure coding perspectives.
Utilize application security scanning tools, interpret reports and validate identified vulnerabilities and associated risks

Qualifications And Requirements

Essential qualifications

Bachelor?s or Master?s Degree (IT, Computer Science, Cybersecurity, Telecommunications, Engineering, etc.)
5 -7 years equivalent experience
Professional information security certification (CSSLP, CISM, CEH, CISSP, GPEN, GWAPT, OSCP or similar)
Experience with software penetration testing, architectural risk assessment, threat modelling, static code analysis

and secure code review

Experience with network penetration testing, firewalls configuration, network architecture and security
Experience in manual penetration testing of websites, APIs and networks using a variety of tools and technologies
Experience in testing network isolation, escalation of privileges, authentication, expanding the attack surface and

exploiting vulnerabilities

Experience with mobile application security testing on iOS and Android platforms
Experience securing applications on a myriad of platforms and languages including Java, .Net, Angular, etc.
Experience in OS hardening on Windows and Linux environments
Experience with a variety of testing tools, including: HCL AppScan, Burp Pro Suite, Veracode, Qualys Suite, NMAP,

Metasploit, Kali Linux, Wireshark and OWASP ZAP.

Understanding of common Web Application vulnerabilities like XSS, CSRF, and others

has context menu

Penetration Testing - PT

Skills

Information Technology