Application Security Engineer

Role Overview

Position: Security Consultant

Core Focus: Software security analysis heavily emphasizing third-party applications introduced by employees.

Primary Environment: Predominantly Windows software, with some Linux.

Primary Requirement: First-Principle Systems Knowledge

• Candidates must deeply understand how a computer functions at a low level, regardless of the operating system or software stack running on it.
• The ability to explain core concepts fundamental to modern computing is mandatory, as this foundation is required to effectively reason about security.
• Hiring managers will actively filter for this low-level understanding by looking for hands-on work experience, projects, or hobbies in the following areas:

• Compiler or Operating System design.
• Writing a debugger.
• Computer hardware design (especially secure hardware), including hardware interfacing and instrumentation.
• Code optimization.
• Emulation or Virtualization implementation and design (e.g., utilizing frameworks like QEMU for advanced testing or manipulation). Note: Merely using virtualization technologies as an end-user is insufficient.
• Vintage computing.

Technical Responsibilities & Capabilities

• Reverse Engineering & Analysis: Perform reverse engineering on binaries and conduct network analysis (e.g., interception, decryption) to uncover vulnerabilities, hidden data exfiltration, or unauthorized behaviors.
• Tooling: Familiarity with reverse engineering tools like Binary Ninja is a plus, but tool-agnostic capabilities are expected. Candidates who build custom offensive tooling, fuzzing frameworks, or automated testing protocols strongly align with the desired profile.
• Security Validation: Ensure software complies with internal security guidelines and internal policies (e.g., restricting unauthorized network connections).
• Collaboration: Work closely with internal domain experts, platform engineering teams, frontline support, and end users to deliver findings and suggest practical, balanced workarounds.

Experience & Qualifications

• Experience Level: 3–5+ years of relevant experience (mid-to-senior level).
• Valued Backgrounds: Prior experience in network/system administration, broad technical understanding of process flows, or participation in Capture-the-Flag (CTF) competitions.
• Certifications: Not required or prioritized; demonstrable, hands-on skills take strict precedence over formal certifications.