Associate Security Engineer
First seen by Alion on Aug 5, 2026.
About the Role:
We are looking for a sharp, curious, and fundamentally strong Associate Security Engineer to join our security team. We arent looking for button-clickers who just run automated scanners. We want someone who understands how systems, protocols, and code work under the hood so they can creatively figure out how to break them.
This position is ideal for someone early in their security career who possesses an excellent grasp of networking, basic programming logic, and a relentless drive to master web, mobile, and network penetration testing.
Key Responsibilities:
- Penetration Testing: Conduct hands-on web application, mobile application (Android/iOS), and network-level penetration testing using manual and automated techniques.
- Vulnerability Assessment: Identify security flaws, validate findings to eliminate false positives, and evaluate the real-world business risk of vulnerabilities.
- Cloud & Infrastructure Review: Assess AWS environments for standard cloud misconfigurations (e.g., exposed S3 buckets, overly permissive IAM policies, leaky security groups).
- Report & Remediate: Document technical findings in structured, clear reports and work alongside development teams to explain and help patch the flaws.
- Continuous Learning: Keep up with evolving exploit vectors, new vulnerabilities, and modern application architectures.
Required Skills & Qualifications:
Rock-Solid Fundamentals:
- Deep Protocol Knowledge: You must understand how the internet works. You should easily explain the client-server model, the mechanics of SSH, how tunneling/port forwarding works, and how WebSockets handle persistent connections.
- Application & Mobile Methodologies: A strong conceptual grasp of testing frameworks, specifically the OWASP Top 10 and the OWASP MASVS.
- Basic Programming Literacy: Ability to read and understand code logic (e.g., Python, JavaScript, Bash, or similar) to identify insecure code patterns and write basic scripts to automate your own security workflows.
The Offensive Toolkit:
- Familiarity with industry-standard tools like Burp Suite, Nmap, Wireshark, Metasploit, Frida, or Objection.
Cloud Awareness:
- Basic understanding of core AWS services and the ability to spot common cloud security pitfalls.
The Huge Plus Factors:
- The AI Advantage: Experience or side-projects at the intersection of AI and Security.
- Practical Certifications: Hands-on, practical certifications that prove you can hack, such as OSCP, eWPT, or PNPT.
- Proof of Passion: An active GitHub profile with security tools/scripts, high-quality CTF write-ups, or a proven track record in Bug Bounty programs.
Skills
Cyber Security, Python, Security, Information Security, Penetration Testing, Applications Security, Mobile Security, Network Security, Vulnerability Assessment, iAM