About the project

This job role is responsible for providing subject matter expertise in Penetration Testing to support wider Cyber Security efforts and organization. The successful candidate will operate as part of a global/regional team within the Cybersecurity organization to provide expertise, oversight and assurance around security process, controls, standards and regulatory requirements.

Required

• HTML, XML, JavaScript, JSON, REST, Microservices
• code reviews for Java, Objective C, Swift and Kotlin programming languages

Your responsibilities

• Perform highly technical/analytical security assessments of custom mobile applications, widely understood infrastructure and networks, web services and APIs. This covers manual penetration testing, source code and configuration review.
• Clearly and professionally document root cause and risk analysis of all findings
• Adhere to the security testing process and raise any gaps or opportunities for improvement with manager.
• Work closely with the DevOps teams to ensure that the security testing requirements are met and help automate repetitive tasks.
• Develop understanding of business functionality and apply testing methodology as appropriate to technologies and risks
• Code and demonstrate basic proof-of-concept exploits of vulnerabilities when required.
• Assist with coordination of security testing projects according to a structured process, including writing test plans, test cases and test reports.
• Advise on vulnerability remediation, control implementation and secure development practices
• Assess product release risk and complexity and identify potential misuse scenarios through review of business requirements and design specifications
• Assist with tracking, remediation, and risk acceptance for identified security vulnerabilities.
• Assist in planning, test execution and vulnerability mitigation
• Ensure that company security policies are implemented, enforced, and enhanced when appropriate
• Participate in team discussions to formulate new or enhance existing processes and standards
• Assist in security incident response activities
• Adhere strictly to compliance and operational risk controls in accordance with company and regulatory standards, policies and practices; report control weaknesses, compliance breaches and operational loss events
•  Run evaluations of new security testing technologies and provide recommendations.
• Monitor security industry information sources and keep abreast of events, research, and developments.
• Identify opportunities to improve our processes, quality of the work and efficiencies.
• Mentor junior team members
• Other responsibilities as assigned.

Skills & Experience they require

• Strong grasp of common technologies, protocols and architectures that are commonly used by mobile application. (HTML, XML, JavaScript, JSON, REST, Microservices etc.)
• Strong understanding of software development lifecycles especially DevOps
• Experience with dynamic and static application security testing and associated tools.
• Experience with performing security code reviews for Java, Objective C, Swift and Kotlin programming languages
• Strong initiative, consensus-building and ability to collaborate directly with a variety of clients (business, development, compliance, etc.)
• Experience with mobile security testing frameworks such as OWASP MASVS, OWASP MSTG.
• Knowledge of enterprise application design & common security issues associated with it.
• Advanced knowledge of common security analysis tools and testing techniques especially for the mobile security space.
• Hands-on experience with SAST, DAST, IAST tools and ways to supplement their limitations.
• Knowledge of security verification of mechanisms & technologies such as SSL, Pinning, Biometric Authentication, Out of Band Authentication, JWT, SAML, RASP, Oauth2 etc.

Nice to have

• Professional certifications, but any relevant certification is a bonus.
• Prior software programming and development experience especially of iOS &Android platforms is a plus.
• Prior programming experience with Java, Kotlin, Objective C &Swift programming languages would be a plus.
• Prior experience with security testing or secure application development for a large enterprise would be a plus.
• Prior experience with cloud-hosted applications & services would be a plus.
• Experience in reverse engineering or disassembly considered a plus.

What they offer

• Stable job in professional team,
• Interesting path of career in an international organization,
• Consistent scope of responsibilities,
• Private health care, employees’ benefits.

Note: Prepare your CV in English (PDF), fill in the form and apply! 
Please include in your CV the following clause necessary for the recruitment process: 

I agree to the processing of personal data that I have made available voluntarily in the recruitment process by the Administrator of personal data, i.e. Dotcommunity Spółka z ograniczoną odpowiedzialnością [Ltd.] based in Cracow, 15 Żabiniec Street, 31-215 Cracow, registered in Poland, the Cracow’s District Court – Śródmieście, XI Commercial Division of the National Court Register under number 0000468484, VAT number: 9452174499, (“Dotcommunity”) in order to carry out the recruitment process for the Penetration Testing Team Lead position on the basis of Art.6 item 1a of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Dotcommunity jest zarejestrowana w Rejestrze agencji zatrudnienia (KRAZ) pod numerem 9904.