应用安全工程师 - 中大西洋地区（远程，VA、MD、PA、NC、DC）
Application Security Engineer - Mid-Atlantic region (Remote in VA, MD, PA, NC, D
GuidePoint Security 提供值得信赖的网络安全专业知识、解决方案和服务，帮助组织做出更好的决策并降低风险。通过采用三层、整体的方法来评估安全态势和生态系统，GuidePoint 使一些国内顶尖组织，如财富 500 强公司和美国政府机构，能够识别威胁、优化资源并集成最适合的解决方案以降低风险。
所需经验：
- 精通静态应用安全测试（SAST）工具的实施、运维和故障排除，例如 Semgrep、Snyk、CodeQL、Checkmarx、Veracode 等
- 熟悉持续集成/持续交付（CI/CD）管道工具和流程（如 GitHub Actions、GitLab Runners、Azure DevOps、Jenkins、CircleCI 等）
- 软件工程经验，最好是全栈软件开发，包括现代技术和应用架构
- 使用一种或多种编程语言进行脚本编写和自动化工作的丰富经验
- 对应用安全基础有扎实的理解，包括 OWASP Top 10、威胁建模以及在整个软件开发生命周期（SDLC）中实施安全编码实践
- 愿意接受新兴技术，包括 AI 工具，以更高效地工作、解决问题并推动更好的业务成果
- 出色的书面和口头沟通能力
优先考虑：
- 编写或调整自定义 SAST 规则的经验（Semgrep 或 CodeQL）
- 熟悉其他应用安全工具（如交互式（IAST）、动态（DAST）和 API 安全、SCA 等）
- 熟悉 API 安全工具（如 NoName、Traceable、Salt、Cequence）
- 具备验证漏洞的实际操作经验和熟练使用 Burp Suite
- 对安全开发生命周期有扎实的理解，并有对 Web 应用扫描工具发现的技术漏洞进行分类和修复的经验
- 对自动化安全测试方法和工具有理解
- 在 CI/CD 管道中构建和运行安全工具的经验
- 在开发过程中主动集成安全的经验
- 曾经作为应用安全从业者或软件工程师的经验
教育与专业资质：
- 相关领域的学士学位或同等经验
- 5-7 年信息安全工程经验
查看英文原文
GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions and minimize risk. By taking a three-tiered, holistic approach for evaluating security posture and ecosystems, GuidePoint enables some of the nation’s top organizations, such as Fortune 500 companies and U.S. government agencies, to identify threats, optimize resources and integrate best-fit solutions that mitigate risk.
Required Experience:
- Proficiency with the implementation, operationalization, and troubleshooting of Static Application Security Testing (SAST) tools such as Semgrep, Snyk, CodeQL, Checkmarx, Veracode, etc.
- Understanding of Continuous Integration / Continuous Delivery (CI/CD) pipeline tools and processes (e.g. GitHub Actions, GitLab Runners, Azure DevOps, Jenkins, CircleCI, etc.)
- Experience in software engineering, ideally full stack software development, including modern technologies and application architectures
- Strong scripting and automation experience using one or more programming languages
- Solid working knowledge of application security fundamentals including the OWASP Top 10, threat modeling, and implementing secure coding practices throughout the Software Development Lifecycle (SDLC)
- Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes
- Excellent written and verbal communication skills
Preferred:
- Experience writing or adapting custom SAST rules (Semgrep or CodeQL)
- Familiarity with additional Application Security tools (e.g. Interactive (IAST), Dynamic (DAST) and API security, SCA, etc.)
- Familiarity with API Security tools (e.g., NoName, Traceable, Salt, Cequence)
- Practical hands-on experience validating vulnerabilities and proficiency with Burp Suite
- Strong working knowledge of Secure Development Lifecycles and experience triaging and remediating technical vulnerabilities identified by web application scanning tools
- Understanding of automated security testing approaches and tools
- Experience in building and operating security tools within CI/CD pipelines
- Experience with proactive integration of security into the development process
- Past experience as an application security practitioner or software engineer
Educational & Professional Credentials:
- Bachelor’s degree in a relevant discipline or equivalent experience
- 5-7 years of security engineering experience in the Information Security industry
We use Greenhouse Software as our applicant tracking system and Zoom Scheduler for HR screen request scheduling. At times, your email may block our communication with you. Please be sure to check your SPAM folder so that you don't miss updates on your application.
Why GuidePoint?
GuidePoint Security is a rapidly growing, profitable, privately-held value added reseller that focuses exclusively on Information Security. Since its inception in 2011, GuidePoint has grown to over 1,300 employees, established strategic partnerships with leading security vendors, and serves as a trusted advisor to more than 6,200 customers.
Firmly-defined core values drive all aspects of the business, which have been paramount to the company’s success and establishment of an enjoyable workplace atmosphere. At GuidePoint, your colleagues are knowledgeable, skilled, and experienced and will seek to collaborate and provide mentorship and guidance at every opportunity.
This is a unique and rare opportunity to grow your career along with one of the fastest growing companies in the nation.
Some added perks….
- Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions)
- Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans (spouse/children/family) or High Deductible Health Plan with HSA (GuidePoint pays 100% of the employees premiums and 75% for family plans (spouse/children/family). If you choose the High Deductible / HSA plan, GPS will contribute in 4 equal quarterly installments: ($850 per EE annually / $1750 per family annually (includes spouse/children/family options)
- Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans
- 12 corporate holidays and a Flexible Time Off (FTO) program
- Healthy mobile phone and home internet allowance
- Eligibility for retirement plan after 2 months at open enrollment
- Pet Benefit Option
Originally posted on Himalayas