AppSec Specialist

About The Job:

• The Application Security Engineer (Threat Modeling) operates as a mid-level individual contributor focused on securing our business-standard web applications.
• In this role, you will own the day-to-day security-by-design initiatives by systematically applying the STRIDE methodology to identify architectural flaws before code deployment.
• You will collaborate directly with product engineering teams to uncover and mitigate Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege risks.
• Exp: 9 to 12 years

Essential Job Functions:

• Conduct STRIDE Assessments:
  • Independently perform threat modeling on core web applications, APIs, and microservices using the STRIDE framework.
• Deconstruct Web Architecture:
  • Analyze data flow diagrams (DFDs), component architecture, and trust boundaries to map out potential attack paths.
• Define Actionable Requirements:
  • Translate STRIDE findings into clear, developer-friendly user stories and acceptance criteria within Jira or engineering backlogs.
• Track Mitigation Lifecycles:
  • Monitor the implementation of security controls and verify remediation.
• Maintain Threat Repositories:
  • Keep threat models up to date as application features evolve.

Qualifications:
Technical Qualifications

• Experience: 3 to 5 years of experience in Application Security, Product Security, or software development with a heavy focus on security design.
• Web App Security Expertise:
• Solid understanding of web technologies, HTTP protocols, browser security (CORS, CSP, SameSite cookies), and the OWASP Top 10.

• Demonstrated experience breaking down functional application designs into STRIDE categories to catch flaws early.
• Modern Development Stack:
  • Familiarity with standard web stacks (e.g., React, Node.js, Java, .NET) and modern CI/CD software pipelines.

• Hands-on experience with tools like the Microsoft Threat Modeling Tool, OWASP Threat Dragon, IriusRisk, or similar diagramming solutions.

• Independent Execution:
• Ability to manage multiple threat modeling projects concurrently with guidance only on highly complex architectures.
• Engineering Empathy:
  • Skill in collaborating constructively with software engineers, offering practical remediation advice rather than just pointing out flaws.
• Clear Communication:
  • Ability to articulate technical security risks and their direct business impacts clearly in both written reports and verbal discussions.