Website:
huntingcube.ai
Job details:
Job Description
Key Responsibilities
- Review designs and code: Threat-model sensitive workflows early enough to influence implementation. Cover login, session lifecycle, password recovery, invitations, document access and sharing, uploads, downloads, and admin actions.
- Test authorization thoroughly: Assess REST, GraphQL, WebSocket, and service-to-service paths for missing or inconsistent controls. Build tests for cross-user and cross-organization access, revoked permissions, expired credentials, and unintended anonymous access.
- Find, fix, and verify vulnerabilities: Reproduce findings safely, explain impact, write or pair on production fixes, and add regression tests. Follow changes through deployment and retesting.
- Lead internal security training: Define the security best practices engineering teams should follow and make sure they are adopted.
- Build security automation: Introduce and tune code, dependency, secret, container, and configuration checks in CI/CD. Make findings actionable and prevent recurring bug classes through secure shared components and regression tests.
- Partner on infrastructure boundaries: Work with platform and SRE engineers on least privilege, workload identities, secrets rotation, storage access, private internal endpoints, and separation of production, testing, and research environments.
- Support incident response and disclosure: Triage researcher reports, investigate evidence, support containment and recovery, and document remediation.
Required Qualifications
- 10+ years of total experience, with at least 5 years in security-focused work.
- Strong experience securing production web applications and APIs, with examples of vulnerabilities you understood and helped fix.
- Ability to read unfamiliar code and write maintainable fixes or security tooling in at least one backend language. The stack includes Go, TypeScript/JavaScript, and Python.
- Depth in HTTP and browser security, authentication and authorization, session handling, API abuse, and common vulnerability classes.
- Hands-on manual testing with tools such as an intercepting proxy, code scanners, or custom tooling, and the ability to validate results and explain false positives.
- Working knowledge of cloud IAM, Linux, containers, CI/CD, and secrets management.
- Clear technical writing, disciplined handling of sensitive data, and the ability to take a finding from discovery to verified closure.
Required Skills
['Go', 'Python', 'Cloud IAM', 'Application Security', 'Web Applications']
Additional Information
NA
Click on Apply to know more.
