Sr Application Security Testing Consultant

$87,000 - $161,400/Yr

BMO - Jacksonville, FL

Full-time - Mid Level

Jacksonville, FL

Credit Intermediation and Related Activities

About the position

The Sr Application Security Testing Consultant at BMO Financial Group is responsible for executing and coordinating security testing activities for BMO applications. Reporting to the Lead of DevSecOps, this role involves conducting Static and Dynamic Application Security Testing (SAST/DAST), providing information security consulting services, and collaborating with developers and stakeholders to enhance security measures. The consultant will also participate in the execution of the information security strategy, ensuring compliance with regulatory requirements and identifying security gaps.

Responsibilities

• Provide technical leadership as a Security Testing subject matter expert.
• Assist in the execution of security testing operations including pre-engagement, engagement, and post-engagement activities.
• Deliver security testing projects according to a structured process, including writing test reports.
• Oversee and execute the configuration and deployment of security testing software.
• Work with leadership to mature security testing team capabilities and provide remediation guidance.
• Conduct risk assessments to identify security gaps and recommend corrective actions.
• Assist in executing technical security assessments of web applications, API security testing, and backend applications.
• Advise on secure development practices and identify potential misuse scenarios.

Requirements

• 5 - 7 years of relevant experience in application security testing.
• Post-secondary degree in Computer Science, Information Systems, or a related field, or equivalent experience.
• Proficiency in coding languages such as C#, JAVA, JavaScript, TypeScript, Python.
• Knowledge of rapid development processes like Waterfall and Agile.
• Understanding of coding vulnerabilities, frameworks, and patching processes.
• Familiarity with OWASP Top 10 and secure coding frameworks.
• Knowledge of secure coding techniques and secure code reviews.
• Familiarity with network protocols and connectivity.
• Experience with CI/CD integration of AppSec Testing Tools.

Nice-to-haves

• CISSP, CISSLP, GIAC, OSCP, OSWE, GWAPT, GMOB, GPEN, GXPN, GAWN certifications are an asset.

Benefits

• Health insurance
• Tuition reimbursement
• Accident and life insurance
• Retirement savings plans
• Performance-based incentives
• Discretionary bonuses