Application Security Specialist
Application Security Specialist Washington, DC (metro accessible) Under the supervision of the Chief Information Security Officer, and Application Security Lead, the Application Security Specialist will drive the design and adoption of application/operational security controls in compliance with the information security policies and standards. The specialist will assist Application Security Lead and Information Security Risk Managers for the continuous development of defensible architectures that align with the security architecture principles/information security risk tolerances, and are resilient against an evolving threat environment. This specialist will bridge the gap between technical requirements and actual implementation guidance.AREAS OF EXPERTISE:Designing, implementing and maintaining Secure Applications and Application Security Architectures at organizations with regulatory compliance requirementsInformation Risk, IT Security, Vulnerability and Compliance ManagementApplication Penetration testingSecure Software DevelopmentApplication security development and Application Security architecture trainingIT Security in the areas of identity and access management, application security, application layer firewalls, web server security, and database system securityApplication Security Process ImprovementEXPERIENCE:Must have hands on experience in conducting threat modeling, automated/manual penetration testing, and code review Enterprise security architecture principles, standards and reference architectureRisk management and control frameworks including ISO 27003, NIST SP 800-53, COSO, COBITIT GRC toolsSecurity architecture principles and modelsIdentity and access management technologies: RBAC, SSO, cloud SSO, and federationAuthentication and authorization technologies: multifactor, AD, kerberos, LDAP, fine/coarse-grained authorization, PKI, cryptographic techniques/algorithmsWeb services security: SAML, WS-federation, WS-security, SOA, REST, WCF Threat modeling techniques Advanced programmingApplication security testing toolsSecurity monitoring: SEIM, Arcsight, advanced correlation logicJOB RESPONSIBILITIES: Supports Application Security Lead, Information Security Risk Management and compliance officers by ensuring Applications and solutions are compliant to policies & Standards delivering alignment to the target security postureLeads ongoing scanning and penetration testing of applicationsGuides penetration testers and application vulnerability specialist in conducting assessmentsConducts threat modeling and technical risk assessments, ensures information security risk and control issues are clearly documented, and works with project teams to develop pragmatic risk remediation plans to address issuesWorks with solution/enterprise architects, application teams, and project managers to design and implement application security controlsWorks with application development teams to drive solutions through their lifecycle, influencing application security architecture, design, testing, road-map development, growth strategies, and business process integrationAdvises application teams on secure development practices including secure coding, security testing, defining scan profiles, designing and implementing common application security services, designs and improves existing application security tool deployments including static analysis and runtime testing toolsProvides hands-on guidance and implementation expertise for performing secure code reviews, automated/manual penetration testing for applications
Experis is an Equal Opportunity Employer
Job Type:Contract
Location:Washington D.C., DC
Date Posted:Jan 30, 201921 days ago
Industry:IT
Application Security Specialist Washington, DC (metro accessible) Under the supervision of the Chief Information Security Officer, and Application Security Lead, the Application Security Specialist will drive the design and adoption of application/operational security controls in compliance with the information security policies and standards. The specialist will assist Application Security Lead and Information Security Risk Managers for the continuous development of defensible architectures that align with the security architecture principles/information security risk tolerances, and are resilient against an evolving threat environment. This specialist will bridge the gap between technical requirements and actual implementation guidance.AREAS OF EXPERTISE:Designing, implementing and maintaining Secure Applications and Application Security Architectures at organizations with regulatory compliance requirementsInformation Risk, IT Security, Vulnerability and Compliance ManagementApplication Penetration testingSecure Software DevelopmentApplication security development and Application Security architecture trainingIT Security in the areas of identity and access management, application security, application layer firewalls, web server security, and database system securityApplication Security Process ImprovementEXPERIENCE:Must have hands on experience in conducting threat modeling, automated/manual penetration testing, and code review Enterprise security architecture principles, standards and reference architectureRisk management and control frameworks including ISO 27003, NIST SP 800-53, COSO, COBITIT GRC toolsSecurity architecture principles and modelsIdentity and access management technologies: RBAC, SSO, cloud SSO, and federationAuthentication and authorization technologies: multifactor, AD, kerberos, LDAP, fine/coarse-grained authorization, PKI, cryptographic techniques/algorithmsWeb services security: SAML, WS-federation, WS-security, SOA, REST, WCF Threat modeling techniques Advanced programmingApplication security testing toolsSecurity monitoring: SEIM, Arcsight, advanced correlation logicJOB RESPONSIBILITIES: Supports Application Security Lead, Information Security Risk Management and compliance officers by ensuring Applications and solutions are compliant to policies & Standards delivering alignment to the target security postureLeads ongoing scanning and penetration testing of applicationsGuides penetration testers and application vulnerability specialist in conducting assessmentsConducts threat modeling and technical risk assessments, ensures information security risk and control issues are clearly documented, and works with project teams to develop pragmatic risk remediation plans to address issuesWorks with solution/enterprise architects, application teams, and project managers to design and implement application security controlsWorks with application development teams to drive solutions through their lifecycle, influencing application security architecture, design, testing, road-map development, growth strategies, and business process integrationAdvises application teams on secure development practices including secure coding, security testing, defining scan profiles, designing and implementing common application security services, designs and improves existing application security tool deployments including static analysis and runtime testing toolsProvides hands-on guidance and implementation expertise for performing secure code reviews, automated/manual penetration testing for applications
Experis is an Equal Opportunity Employer