استخدام security engineer

توضیحات آگهی

Over View
The Senior Security Engineer is part of Digikala s Offensive Security team and is responsible for identifying and reducing security risks across web applications APIs and supporting services The role exists to detect vulnerabilities before they can be exploited support secure product delivery and help development teams remediate security issues effectively This position works closely with Development DevOps Cloud SOC Infrastructure and Product teams
Responsibilities
Perform comprehensive black box grey box and white box penetration testing of web applications APIs microservices and internal services Identify high impact vulnerabilities including authentication bypass authorization issues IDOR SSRF injection flaws business logic weaknesses and sensitive data exposure
Complete assigned security assessments within agreed timelines and provide clear reproducible and risk based reports
Validate remediation actions and ensure that critical and high severity vulnerabilities are properly resolved before production deployment
Support DevSecOps processes by reviewing findings from SAST DAST secret scanning dependency scanning and container security tools
Conduct threat hunting activities for exposed assets vulnerable services leaked credentials public repositories and newly published CVEs
Provide practical remediation guidance and work directly with engineering teams to reduce security risks
Improve penetration testing methodologies automation scripts security rules and internal technical documentation
Requirements
At least five years of professional experience in penetration testing application security or offensive security
Advanced knowledge of web application and API security
Strong understanding of OWASP Top 10 and OWASP API Security Top 10
Hands on experience with REST APIs GraphQL authentication authorization OAuth 2 0 OpenID Connect JWT and session management
Strong experience identifying complex business logic and access control vulnerabilities
Proficiency with tools such as Burp Suite Professional Nmap Nuclei OWASP ZAP and Wireshark
Knowledge of Linux Docker Kubernetes cloud environments and CI CD pipelines
Familiarity with DevSecOps tools such as Semgrep Gitleaks Trivy DefectDojo and dependency scanning solutions
Ability to develop security automation using Bash Go or similar languages
Strong analytical thinking problem solving and attention to detail
Ability to assess technical findings based on exploitability and business impact
Strong technical reporting and documentation skills
Effective communication and teamwork across technical and non technical teams
Ability to work independently manage multiple assessments and take ownership of security risks
Ability to mentor junior security engineers and review penetration testing results
Certifications such as OSCP OSWE OSEP BSCP or similar are preferred but not mandatory
شرکت دیجی کالا Digikala
دسته بندی IT DevOps Server
نحوه همکاری تمام وقت
نوع همکاری حضوری
مدرک تحصیلی کارشناسی
سابقه کار سه تا شش سال
حقوق توافقی
جنسیت مهم نیست
مهارت ها Network Security Linux امنیت شبکه
شهر تهران تهران