We are looking for a highly motivated, talented, and hands-on Application Security Engineer who will participate in building our next-generation static code analysis engines for detection and remediation capabilities. 
This role offers challenges across a wide variety of responsibilities. You will have an opportunity to establish the application security discipline in the SAST group, and define working procedures, processes, and tools. 

The successful candidate will work closely with algorithms developers, improving the engines, developing security rules, performing a security review of source code, and suggesting optimization. We are searching for a team player with a can-do approach.

Application security leader will work very closely with code analysis algorithm developers, he will enrich them with application security knowledge. It's a rare opportunity to make an impact on the application security market, by establishing the field of application security research in Mend, building the best in market static code analysis tool. You will be researching different programming languages for variety of CWE's


what you will do :

- Performing security source code analysis.
- Analyze application vulnerabilities and provide mitigation strategies.
- Researching, designing, and writing application security rules for detection, while working closely with a development team for SAST.
- Analyzing different programming frameworks in different programming languages for potential sources and sinks for SAST.
- Handling complex cases escalated from the field and other teams.
- Improving Mend SAST engines for various programming languages.


You must have:

- Experience with security review of source code – Must!
- At least 5 years of experience in application security or security research, including the understanding of application security attacks, vulnerabilities, and mitigations- Must!
- Knowledge of common Web Application security vulnerabilities (OWASP TOP10, SANS 25, etc.) – Must!
- Experience with at least 2-3 of the following programming languages -Java, C#, Go, JS, Python, PHP, Ruby, etc- Must!
- Language agnostic approach to vulnerability identification in the source code (ability to read multiple programming languages source code and identify vulnerable parts).
- Proven experience leading tasks and projects end-to-end, passion to grow to a TL position
- Excellent English – written and verbal.
- Excellent interpersonal and communication skills.


Nice to have:

- BSc or BA in Computer Science or a similar degree
- Experience in managing application security engineers
- Experience working with development teams.
- Experience with bug bounty research or published advisories or exploits for discovered 0day vulnerabilities in applications.


The recruitment process:

1.Initial phone call – Recruiter (20 minutes)
2. Technical interview including code review questions (Zoom) – VP Engineering (1 hour)
3. Home task 
4. 2nd technical interview (Zoom) 
5. Final interview with EVP and HR (in the office) – 45 minutes each