Developer III

Overview:

The Application Security Developer III will work closely with both engineering (development) teams and the Information Security group to make sure that RealPage applications are developed with security in mind. Deep awareness of the OWASP Top 10 project and practices for preventing vulnerabilities when developing applications in any tech stack is a key success factor. This person will help to ensure Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Software Composition Analysis (SCA) occurs during the development lifecycle and that reported vulnerabilities are properly remediated.

Responsibilities:

• Shift-Left security in Software Development Life Cycle (SDLC) for various applications.
• Provide guidelines, tooling, best practices and implement for:
• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Software Composition Analysis (SCA)
• Runtime Application Self-Protection (RASP)
• Provide guidance and coaching to teams regarding security remediation efforts
• Provide guidance to teams on how to properly integrate SAST, DAST, SCA scans into their pipelines
• Work with teams to ensure dependency scans are also part of their development process and pipelines
• Provide ongoing improvements and awareness training on new application threats and remediation techniques
• Provide guidance on OpenID Connect (OIDC) and OAuth2 and other identity-related best practices and practical approaches for client implementation
• Help engineering teams plan long term remediation solutions when deep changes are required for remediation activities
• Collaborate with the Information Security (InfoSec) team on prioritizing both applications and vulnerabilities based on risk
• Provide guidance to teams on proper storage and retrieval of application secrets
• Develop reference/Proof of Concept (PoC) applications using C#, .NET Core, Python, Microsoft SQL Server, applying best security practices, etc.
• Create reference build/deploy pipelines for Azure DevOps, GitHub using YAML.
• Use AI/ML concepts, models, RAG AI (Retrieval-Augmented Generative Artificial Intelligence) in PoC / reference applications development.
• Deploy PoC / reference applications on the Hyper-scaler cloud providers like Azure, GCP and AWS.
• Work 2 pm - 11 pm shifts in a hybrid model, 2-3 days a week in the office.

Qualifications:

• Minimum 7 years' experience developing commercial SaaS solutions
• Deep familiarity with the OWASP Top 10 and other security concerns for web applications
• Familiarity with OWASP Application Security Verification Standards (ASVS)
• Familiarity with SAST, DAST, SCA Scans
• Familiarity and deep understanding of OWASP ASVS.
• Advanced understanding of OpenID Connect (OIDC) and OAuth2 and recommended practices for web and mobile applications
• Understand how to interpret and assess CVEs (Common Vulnerability and Exposures) as found by scanning tools
• Experience working/integrating with secret management systems such as HashiCorp Vault or AWS Secrets Manager
• Advanced knowledge of front-end and back-end web application development in at least one or more technology stack (.NET, Java, PHP, Ruby/Rails, Angular, , etc.)
• Proficient in C#, Python, Java, SQL programming languages.
• Good understanding of AI/ML concepts, models, RAG AI, etc.
• Track record of staying current with trends, techniques, tools, and processes that drive improvement of security posture of applications
• Strong documentation skills
• Excellent verbal and written communication skills, with proven technical writing abilities
• Team-oriented thinking with demonstrated ability to produce high-quality work as part of a fast-paced, dynamic team
• Proven ability to communicate, collaborate, and present effectively with teams and individuals in different disciplines or areas