高级信息安全工程师- 应用安全方向
Senior Information Security Engineer- Application Security Focus
Hexens.io 正在寻找一位高级信息安全工程师，专注于应用安全，加入我们的团队。在 Hexens.io，我们提供前沿的网络安全服务，核心重点是区块链技术。我们解决复杂的安全挑战，保护处理数百万美元数字资产的应用程序和基础设施。
远程工作：可随时随地工作！这是一个完全远程的职位，无地点限制。
职责：
- 与我们的离链安全负责人一起，针对 API 服务、应用前端、钱包软件、浏览器插件、移动应用和 SDK 进行高级应用安全评估。
- 与领先的智能合约审计师和密码学研究人员合作，利用你的应用安全专业知识，评估他们链上专长之外的攻击面。
- 识别技术漏洞、架构缺陷以及在离链和链上系统关键交界处减轻未来风险的方法。
- 在识别和处理安全问题时，与开发人员和关键利益相关者互动。
- 对发现的问题和攻击路径进行清晰简洁的报告。
所需技能：
- 至少 5 年经验，或同等技术水平，提供进攻性安全服务，主要专注于应用安全。
- 具备专家级的 Web 应用和 API 安全经验，熟练评估使用现代 Web 框架的应用程序，并能识别高级客户端、后端和业务逻辑攻击。
- 具有评估移动应用（Android/iOS）、浏览器扩展和桌面应用的经验。
- 在白盒/灰盒应用安全评估中，有在 Golang、Rust、TS/JS、Python、Java 或 C 基础代码库中发现复杂漏洞和攻击路径的实际经验。
- 熟悉云、CI/CD、容器、CDN 和网络安全部分的概念，以及它们如何应用于应用安全。
- 了解或愿意学习 Web3 安全概念及其在 Web3 为中心的应用中的应用。
- 良好的脚本编写和自动化技能。
- 协助制定应用安全工作的范围要求。
- 强大的客户沟通和软技能。
如有以下任何经历将是一个加分项：
- 显著的 Web2 漏洞赏金/漏洞披露历史。
- 之前作为智能合约审计师或链上安全研究人员的经验。
- 之前有开发或集成经验
查看英文原文
Hexens.io is looking for a Senior Information Security Engineer with a strong focus on application security to join our team. At Hexens.io, we deliver cutting-edge cybersecurity services with a core emphasis on blockchain technology. We address complex security challenges, protecting applications and infrastructures that handle multimillion-dollar digital assets.
Remote Availability: Work from anywhere! This is a fully remote role with no location restrictions.
Responsibilities:
- Alongside our off-chain security lead, plan and deliver advanced application security assessments against API services, application front-ends, wallet software, browser plugins, mobile apps, and SDKs.
- Collaborate with leading smart contract auditors and cryptography researchers, leveraging your application security expertise to assess attack surfaces outside their on-chain specializations.
- Work to identify technical vulnerabilities, architectural flaws, and ways to mitigate future risk in the crucial junctions between off-chain and on-chain systems.
- Interact with developers and key stakeholders when identifying and handling security issues.
- Deliver clear and concise reporting on issues and attack paths identified.
Required skillset:
- At least 5 years experience, or equivalent technical expertise, delivering offensive security services, with a primary focus on application security.
- Expert-level web application and API security experience, with proficiency assessing apps with modern web frameworks, and identifying advanced client-side, back-end, and business logic attacks.
- Experience assessing mobile applications (Android/iOS), browser extensions, and desktop applications.
- Practical experience finding complex vulnerabilities and attack paths in Golang, Rust, TS/JS, Python, Java, or C-based codebases during white/grey-box appsec assessments.
- Working knowledge of cloud, CI/CD, container, CDN, and network security concepts, and how they apply to application security.
- Knowledge or willingness to learn web3 security concepts and how they apply to web3-centric applications.
- Decent scripting and automation skills.
- Assisting with scoping requirements for application security work.
- Strong client-facing and soft skills.
Big plus if any of the following apply:
- Significant web2 bug bounty/vulnerability disclosure history.
- Prior experience as a smart contract auditor or onchain-focused security researcher.
- Prior experience developing or integrating DeFi protocols, smart contracts, wallet services, or other web3 services.
- Advanced relevant security certifications (OSWE, Burp Suite Certified Professional, etc.)
- Benefits:
- Work alongside industry-leading specialists
- Opportunity to work with the most exciting and prominent companies in the industry
- Highly competitive salary
- Great work environment
Originally posted on Himalayas