Google

Application Security Consultant, Google Cloud, Mandiant Consulting

About the job

  • Conduct comprehensive security assessments of Web applications, APIs, and Mobile applications by identifying, exploiting and validating vulnerabilities using industry-standard methodologies such as the OWASP Web Security Testing Guide (WSTG), OWASP API Security Top 10, and OWASP Mobile Application Security Testing Guide (MASTG).
  • Discover critical vulnerabilities in applications and be able to weaponize them.
  • Expand the team's capabilities through tool creation, research on offensive techniques, incorporation of threat actor intelligence, internal presentations and knowledge share.
  • Develop comprehensive and accurate reports and presentations for both technical and executive audiences, and act as a trusted advisor to c-level, security leaders and other customer stakeholders.
  • Assist with scoping prospective engagements, leading teams for engagements from kickoff through remediation phase, as well as mentoring other staff.

    • Minimum qualifications:

  • Bachelor's degree in Cybersecurity, with a focus on offensive security or equivalent practical experience.
  • 3 years of experience in three of the following security areas: web application security assessment, mobile application security assessment, API security assessment, red team assessments, EDR evasion, exploit development, cloud, social engineering, scripting, tool development.
  • Experience delivering reporting and presentations to both technical and executive audiences.
  • Experience with operating system security across operating systems or Linux.

    • Preferred qualifications:

  • Certifications related to application security including BSCP, OSWE, eWPTX, eMAPT, 8ksec CMSE or relevant SANS courses.
  • Experience in creating security tools and understanding of underlying programming languages (such as Python, C#, C/C++, Rust, Nim or similar).
  • Experience conducting web application, API, and mobile (iOS and Android) security assessments following industry standards such as OWASP WSTG/ASVS, OWASP Top 10, OWASP API Top 10 and OWASP MASVS/MASTG.
  • Experience in web application and API penetration testing tooling including Burp Suite Professional, Burp Suite extensions, Postman, nuclei, ffuf and sqlmap.