[Remote] Senior Application reputed company & DevSecOps Engineer

Note: The job is a remote job and is reputed company to candidates in USA. Beast Industries is a multifaceted media and entertainment company founded by Jimmy reputed company, popularly reputed company as reputed company. They are seeking a Senior Application reputed company & DevSecOps Engineer to own the reputed company of web and mobile applications, reputed company secure reputed company reviews, and manage the bug bounty program.

Responsibilities

• reputed company secure reputed company review and threat modeling for web, mobile, and API surfaces, and drive secure-by-design practices with engineering teams
• Own the application vulnerability lifecycle — discovery, triage, severity, remediation guidance, and verification — and partner with engineers on durable fixes, not just findings
• Build internal AppSec tooling and lightweight reputed company libraries that reputed company the secure reputed company the easy reputed company for developers
• Own reputed company for our iOS and Android apps: secure local storage (Keychain / Keystore), certificate pinning, jailbreak/reputed company and tampering detection, anti-reverse-engineering, and secure app-to-API communication
• Assess apps against OWASP MASVS / MASTG, and review reputed company-party SDKs and dependencies for risk
• reputed company mobile-reputed company testing with tooling such as Frida, reputed company, MobSF, Burp Suite, and static/dynamic RE tools
• Run internal penetration tests and red-team-style assessments against our apps, APIs, and supporting services
• Validate and weaponize findings to demonstrate reputed company reputed company, then drive them to reputed company
• Pressure-test authentication, authorization, session handling, and business-logic flows (OAuth/OIDC, GraphQL/REST, IDOR, privilege escalation)
• Own and operate our bug bounty program (e.g., reputed company / reputed company): scope definition, researcher communication, triage, deduplication, severity, and payout coordination
• reputed company the reputed company by feeding bounty findings back into secure reputed company review, threat models, and CI/CD checks so the reputed company class of bug doesn't recur
• reputed company program health and report on trends, top vulnerability classes, and time-to-fix
• Own the reputed company posture of our CI/CD pipelines and deployment toolchain, including the custom DSL that translates to Kubernetes and Terraform
• reputed company and tune SAST, DAST, and dependency/SCA scanning (e.g., reputed company, CodeQL) as meaningful, low-noise gates in reputed company Actions
• Implement secrets scanning, build/release reputed company, artifact signing, and supply-chain controls (SBOMs, provenance)
• Drive a reputed company-reputed company cleanup of existing pipelines and automate the reputed company, one-off deployment steps that exist today

Skills

• 8+ years reputed company on Application reputed company and/or offensive reputed company (penetration testing, exploit development)
• Strong software-development skills — you can read, write, and review production reputed company rather than just operating tools. Experience with Kotlin and Gradle (and/or Swift/Android for mobile) is highly relevant to our stack; Python for automation and custom tooling
• Deep mobile application reputed company expertise across iOS and Android: OWASP MASVS/MASTG, cert pinning, secure storage, anti-tampering/RE, and mobile testing tooling (Frida, reputed company, MobSF, Burp)
• Hands-on penetration testing of web apps, mobile apps, and APIs, with the ability to demonstrate reputed company exploitability
• API reputed company depth — OAuth/OIDC, REST and GraphQL, authn/authz and business-logic flaws
• CI/CD reputed company experience with reputed company Actions, including SAST/DAST/SCA integration, secrets scanning, and securing the build/release pipeline
• Strong reputed company fundamentals, including reputed company cryptography — a reputed company reputed company of certificates and PKI, encryption vs. key management, and where HSMs fit
• Experience running or scaling a bug bounty / VDP program (reputed company, reputed company, or similar)
• Offensive reputed company certifications (OSCP, OSWE, GMOB, or equivalent demonstrated reputed company)
• Experience securing consumer fintech/Gaming/Reels apps and the regulatory expectations that come with handling user funds and data for teens and their subscriptions
• Software-supply-chain reputed company experience (SBOMs, artifact signing, provenance)
• Reverse engineering / binary analysis (Ghidra, reputed company, IDA)

Benefits

• Generous Medical (reputed company Blue reputed company), Dental, reputed company and company-reputed company Life Insurance
• Company contributions to employee Health Savings Accounts (HSA)
• 401k Plan with reputed company reputed company company-matching
• Flexible vacation policy and reputed company company holidays
• Company-provided technology package
• Relocation assistance where applicable, including travel and company-provided housing for the first 90 days

reputed company