Deep, hands-on expertise with DAST tooling (e.g., Burp Suite, OWASP ZAP, Invicti, Acunetix, StackHawk) including authenticated scan configuration, scan policy tuning, and API scanning.
Demonstrated hands-on experience with dynamic application security testing (DAST) of web applications and APIs.
Experience operationalizing DAST at scale — pipeline integration, scheduled scanning across a large application estate, results triage workflows, and reducing false-positive rates over time.
Relevant security certifications such as CEH, OSCP, CISSP, or GWAPT from an industry-recognized certifier (e.g., SANS/GIAC, CompTIA, ISACA, ISC2).
Strong knowledge of secure software development methodologies, including threat modeling, code review, and static/dynamic analysis.
Deep understanding of common application vulnerabilities (e.g., OWASP Top 10) and their mitigations, with the ability to manually verify and exploit findings to confirm real risk.
Experience integrating security into DevOps (DevSecOps) and CI/CD environments.
Strong technical knowledge of web application security, cloud security (AWS, Azure, GCP), mobile security, infrastructure as code, containerized environments (Docker, Kubernetes), and API security.
Hands-on experience across the wider testing toolchain — SAST, SCA, IAST, and fuzzing tools.
Experience identifying security defects in container images and Kubernetes environments.
Advanced proficiency writing source code in at least one programming language (e.g., Java, JavaScript, C/C++/C#, Python) and familiarity with common build and dependency tooling (e.g., Maven, Gradle, Node).
Experience with cloud deployment and automation tooling (Terraform, GitHub Actions, Jenkins, AWS CloudFormation, secrets managers).
Working knowledge of encryption, authentication, and access control.
Knowledge of compliance and regulatory frameworks (e.g., SOC 2).
