Application Security Engineer

About WeTransfer

WeTransfer was founded in 2009 as the simplest way to send big files around the world. Today we’re a set of beautifully obvious tools to keep your ideas moving. At WeTransfer we understand you’ve got better things to do. It’s why, after ten years, we still keep things simple, make things stylish and stay away from any funny business.

In 2019, Fast Company named WeTransfer one of the world’s most innovative design companies “for being a one-stop-shop for creativity tools.”

Position

Partner with global WeTransfer teams (product and otherwise) to continually improve our products’ security at all phases of the software development lifecycle. Get your hands dirty with finding and fixing security issues. Educate and inform colleagues (inside and outside of product) about application security. Interact with the security community external to the company and gather information regarding current and future threats. If and when an incident occurs, take a major part in responding - working with the developers, Data Protection Officer, internal IT, support and PR teams to make sure the problem is solved and correctly communicated.

Responsibilities:

• Work with product designers and developers to ensure our applications are beautifully secure
• Work with platform and core services teams to make sure that our infrastructure is properly protected
• Implement security tools that will help us tackle possible threats
• Manual testing of our products to reveal and mitigate possible security flaws
• Assist in creating comprehensive threat models for our products
• The triage and communication around our responsible disclosure program
• Support and expand our security culture through trainings
• Answer questions from colleagues about security issues
• Work with Information Security and IT Services to ensure awareness and compliance throughout the business

Your qualification

• Ability to perform manual security testing and come up with mitigation suggestions
• Knowledge of common and not so common vulnerabilities (OWASP top 10, etc)
• Knowledge of common security standards and frameworks (ISO 27001, NIST, etc)
• Familiarity with security analysis tools - everything from Burp suite to Kibana to the various security tools AWS provides
• Some familiarity with Ruby/Rails/React/Sinatra
• Some familiarity with AWS systems
• Strong verbal and written communications skills (English)

Will be a plus

• Extensive penetration testing experience followed by certifications such as OSCP, OSCE, OSWE
• Security Incident Response experience
• Proven experience in a similar role
• Developed custom security tools
• Worked with languages other than Ruby (e.g., Python, R, Go, C or Haskell)
• Contributed to Open Source projects