Application Security Engineer

We are looking for a Versatile Application Security Engineer to join the team to continue to mature the application security practices at BitGo. This exciting opportunity empowers you to ensure vulnerabilities are prevented or detected as early as possible. You get the opportunity to make a real and meaningful difference. We want you to focus on quality over noise. Automation over manual work. Your work would take place during regular business hours, working with the local team. From time to time, evening meetings will be necessary.

We are looking for teammates who share and practise our values: open communication, transparency, taking ownership, and a high level of craftsmanship. We are looking for coworkers who share our vision and mission: deliver trust in digital assets.

Responsibilities:

• Assist in the development of automated security testing to validate that secure coding best practices are being used.
• Assist in the creation and delivery of secure development training.
• Participate in application security reviews and threat modelling, including secure code review, architectural design, and dynamic testing.
• Perform application security vulnerability management.
• Support the bug bounty programme.
• Facilitate and support the preparation of secure releases.
• Support and consult with engineering teams in the area of application security and best practices.
• Drive security projects from ideation to requirements to implementation.
• Mature the security program through the use of the NIST CSF.
• Assist in any relevant incident response activities.

Requirements:

• 5+ years of experience with application security.
• 1-2 years of experience in software development and mobile security.
• Familiarity with common security libraries, security controls, and common security flaws.
• Experience with OWASP, static/dynamic analysis, and common security tools.
• A basic understanding of network and web-related protocols (such as TCP/IP, UDP, IPSEC, HTTP, and HTTPS).
• Experience in the vulnerability management lifecycle.
• Familiarity with cloud security controls and best practices.
• Experience working with developers.
• Excellent and professional communication skills (written and verbal) with an ability to articulate complex topics clearly and concisely.
• Preference for candidates who know some of the programming languages in use at BitGo: TypeScript, Go, Python, Java, and Kotlin.