Application Security Engineer

About WeTransfer

WeTransfer was founded in 2009 as the simplest way to send big files around the world. Today we’re a set of beautifully obvious tools to keep your ideas moving. At WeTransfer we understand you’ve got better things to do. It’s why, after ten years, we still keep things simple, make things stylish and stay away from any funny business.

In 2019, Fast Company named WeTransfer one of the world’s most innovative design companies “for being a one-stop-shop for creativity tools.”

Position

WeTransfer is looking for an Application Security Engineer. At WeTransfer we are trusted everyday by millions of people with their professional, creative and personal content. We focus on making 'beautifully obvious' products, and our goal is to bring 'beautifully secure' to life as well. Security should not come at the expense of user experience, rather it is an integral part of keeping our users in their flow, creating comfortably in the knowledge that their hard work is well protected.

You will be part of the team that is responsible for helping to build a persistent, positive, and most of all sustainable security culture. You will perform a key role in our security efforts both on a practical level (code review, incident analysis) and on awareness level (trainings, mentoring, etc).

Responsibilities:

• Partner with global WeTransfer teams (product and otherwise) to continually improve our products’ security at all phases of the software development lifecycle
• Get your hands dirty with finding and fixing security issues 
• Interact with the security community external to the company and gather information regarding current and future threats 
• If and when an incident occurs, take a major part in responding -- working with the developers, Data Protection Officer, internal IT, support and PR teams to make sure the problem is solved and correctly communicated
• Some projects you will be working on are:
  • Work with product designers and developers to ensure our applications are beautifully secure
  • Work with platform and core services teams to make sure that our infrastructure is properly protected
  • Implement security tools that will help us tackle possible threats
  • Manual testing of our products to reveal and mitigate possible security flaws
  • The triage and communication around our responsible disclosure program
  • Support and expand our security culture through trainings
  • Work with Information Security and IT Services to ensure awareness and compliance throughout the business

Your qualification

• Ability to perform manual security testing and come up with mitigation suggestions
• Knowledge of common and not so common vulnerabilities (OWASP top 10, etc)
• Knowledge of common security standards and frameworks (ISO 27001, NIST, etc)
• Familiarity with security analysis tools - from Burp suite to Kibana to the various security tools AWS provides
• Some familiarity with Ruby/Rails/Sinatra/React and with AWS systems
• Willingness to teach and to learn
• Strong communications skills (English)

Will be a plus

• Extensive penetration testing experience followed by certifications such as OSCP, OSCE, OSWE
• Security Incident Response experience
• Proven experience in a similar role
• Developed custom security tools
• Worked with languages other than Ruby (e.g., Python, R, Go, C or Haskell)
• Contributed to Open Source projects