Software Engineer, Security Focus

About the role

evisit is looking for a hands-on full-stack Software Engineer focused primarily on security remediation, working remotely. The main priority is fixing vulnerabilities found through penetration testing by digging into the codebase, session traffic and infrastructure, and preventing them from recurring. The role works closely with engineering and design teams to turn security findings into testable requirements in Technical Requirements Documents (TRDs), and once the security backlog is under control, the engineer also contributes to application development on the Ruby on Rails and React platform.

Key responsibilities

• Own end-to-end remediation of vulnerabilities from penetration tests and other assessments, from triage through verified fix
• Analyse session traffic between front end and back end with browser-based code inspection tools and turn findings into design and engineering requirements
• Feed vulnerability findings into the TRD process so fixes become durable design requirements
• Review and harden session management across the application stack
• Implement fixes in the Ruby on Rails and React codebase across containerized services (AWS, Fargate)
• Assess and secure real-time and API-driven features, including Pusher and AnyCable, and RESTful APIs
• Document vulnerabilities, root causes, remediation steps and verification results
• Contribute security context and vocabulary to FedRAMP-related discussions
• Design, build and ship features on the Rails back end and React front end, applying lessons learned to avoid reintroducing known vulnerabilities

Required profile

• 5+ years of hands-on full-stack software engineering experience
• 5+ years in a security engineering or closely related role
• Proven experience remediating vulnerabilities found through penetration testing
• Ability to use browser developer tools to inspect network and session traffic and explain risks clearly to engineering and design stakeholders
• Strong written communication skills for documenting vulnerabilities and technical requirements

Required skills

• Ruby on Rails and React
• Containerized environments, AWS and Fargate
• RESTful API design and security considerations
• Pusher and AnyCable, or comparable real-time messaging technologies
• Knowledge of Ruby data models and how schema and query design affect performance and scalability
• AWS Security certification (e.g. AWS Certified Security – Specialty)
• General familiarity with FedRAMP vocabulary and framework

Nice to have: Pulumi, Python, SQL, and active or eligible security clearance.