Are you ready to power the World's connections?

If you don’t think you meet all of the criteria below but are still interested in the job, please apply. Nobody checks every box - we’re looking for candidates that are particularly strong in a few areas, and have some interest and capabilities in others.

About the role:

As a Security Engineer specializing in Vulnerability Management and Testing, you will be critical in ensuring the security of Kong Insomnia. This role focuses on identifying, triaging, and closing vulnerabilities while leveraging advanced security engineering to build and update automated testing pipelines. You will bring expertise in automated security testing while remaining hands-on in manual testing and validation processes.

A key aspect of this role will involve researching and understanding all components of the Kong Insomnia platform, including the underlying technologies and dependencies. Binary analysis is a critical skill, and you will be expected to analyze and reverse-engineer parts of the Kong Insomnia to uncover vulnerabilities and security weaknesses.

Your contributions will directly impact the security of Kong’s products by integrating robust security measures into CI/CD pipelines, conducting in-depth testing, and working closely with development teams to remediate vulnerabilities effectively and efficiently.

What you'll do:

This position will be responsible for performing Comprehensive Security Testing and Analysis:
Conduct both automated and manual testing to uncover vulnerabilities:
1. Static Analysis: Detect insecure coding patterns during development.
Tools: GitHub Advanced Security (CodeQL), SonarCloud, Checkmarx CLI.
2. Dynamic Application Security Testing (DAST): Identify runtime vulnerabilities such as XSS or SQL Injection.
Tools: OWASP ZAP CLI Runner, Burp Suite.
3. Fuzz Testing: Discover unknown vulnerabilities through randomized inputs.
Tools: ClusterFuzzLite, libFuzzer.
4. Dependency Analysis: Identify vulnerabilities in third-party libraries and components.
Tools: Dependabot, Snyk CLI, OWASP Dependency-Check.
5. Environment Simulation and Sandboxing: Test software in isolated environments to simulate real-world attacks.
Tools: Docker, Minikube, Cuckoo Sandbox.
Responsibilities
Vulnerability Triage and Management: Identify, prioritize, and track vulnerabilities from multiple sources, including automated tools, penetration testing, and external reports. Collaborate with development teams to ensure timely remediation of findings.
This position will be responsible for Manual Testing and Validation: Conduct in-depth manual testing to identify vulnerabilities not covered by automated tools. Validate the accuracy of automated findings and ensure comprehensive coverage for critical systems. Provide detailed remediation guidance to development teams based on manual findings.