Security Auditor

About the Role

This role supports our client’s mission to deliver secure, high‑quality software applications across the organization. As a Security Auditor, you will partner closely with full‑stack development teams to embed security best practices throughout the software development lifecycle. You will conduct comprehensive application security assessments, provide actionable remediation guidance, and help raise the overall security posture of the organization. The position operates in a hybrid environment, requiring on‑site collaboration two days per week while maintaining flexibility for remote work on other days.

Key Responsibilities

• Perform dynamic (DAST), static (SAST), and software composition analysis (SCA) assessments on web and cloud‑based applications.
• Collaborate with developers to remediate identified vulnerabilities, providing detailed guidance on secure coding techniques.
• Review and validate HTTP request/response headers and RESTful API implementations for security compliance.
• Educate development teams on the OWASP Top 10 vulnerabilities, including XSS, injection, CSRF, SSRF, and XML entity attacks.
• Develop and maintain security testing scripts and automation within CI/CD pipelines.
• Document findings, produce audit reports, and track remediation progress with stakeholders.
• Participate in design reviews and threat modeling sessions to proactively identify security risks.
• Assist in establishing secure coding standards and best‑practice guidelines for the organization.

Required Skills & Experience

• 5+ years of experience in application security auditing or secure software development.
• Strong development background with proficiency in full‑stack technologies (e.g., Java, .NET, JavaScript, Python).
• Deep understanding of OWASP Top 10 vulnerabilities and practical experience mitigating them.
• Hands‑on experience with application security scanning tools (SAST, DAST, SCA, ASOC) and container/cloud security scanners.
• Ability to analyze HTTP request/response headers and RESTful API security configurations.
• Excellent communication skills to convey complex security concepts to technical and non‑technical audiences.
• Bachelor’s degree in Computer Science, Information Security, or a related field; relevant certifications (e.g., CISSP, OSCP, GSEC, or CSSLP) are a plus.

Tools & Technologies

• SAST tools such as Checkmarx, Veracode, or Fortify.
• DAST tools like OWASP ZAP, Burp Suite, or Netsparker.
• SCA solutions including Snyk, Black Duck, or Sonatype Nexus.
• Container and cloud security scanners (e.g., Trivy, Anchore, or Prisma Cloud).
• CI/CD platforms (Jenkins, Azure DevOps, GitLab) for integrating automated security testing.
• Version control systems (Git) and issue‑tracking tools (Jira) for managing remediation workflows.

Work Schedule & Duration

• One‑year contract with the possibility of extension.
• Hybrid schedule: onsite at the Dimondale office Wednesdays and Thursdays; remote work the remaining days.
• On‑site requirement from day 1; no remote‑only option.
• Candidate must reside within 90‑100 miles of Dimondale, MI.
• Start date: October 5, 2026.

Interview Process

The interview process begins with a virtual interview conducted via Microsoft Teams. Successful candidates will then be invited to an in‑person interview at the Dimondale office. Both technical and behavioral assessments will be part of the process.

Position Details

• Employment Type: Contract
• Duration: Approximately 12 months (with potential for extension)
• Work Authorization: Must be authorized to work in the United States