Atlassian is seeking two application security engineer for its Sydney office.
The engineers will be responsible for application security in Atlassian products and services such as JIRA, Confluence, Bitbucket, Hipchat and OnDemand.
They will use their application security knowledge to write production-grade software for the small Atlassian team to use.
Candidates will develop security tools and improve existing ones for attack detection, compromise detection, and vulnerability discovery and find vulnerabilities in Atlassian products and services.
Team lead Vitaly Osipov said the company is seeking a person with strong code auditing skills who would also be comfortable using Burp Suite and talented developer who can write large scale data processing code and is familiar with information security.
"Both have to be a good cultural fit and both have to be able to work with non-security teams," Osipov said.
Each applicant sits a basic automated Java test (not a coding task) that is designed to test either basic knowledge of Java, or an individual's attitude and learning skills.
Osipov said the company was not seeking those who:
- Do only blackbox vulnerability scanning or penetration testing (although Atlassian does some testing of apps.
- Run 100 percent manual code reviews because of the large amount and rapid changes in Atlassian code.
- Cannot write their own tools
- Have application security experience limited, for example, to running Appscan or Fortify.
- Do not feel comfortable working with developers to get vulnerabilities fixed.
- Think their job is to police 'stupid developers'.
Atlassian will sponsor Australian work visas for the right candidates.
Skills
- Delivered production software in Java and Python, ideally both
- Experience in conducting application security assessments
- Past experience in Agile software development environments, ideally at a software vendor
- Published security research or conference talks
- Ability to handle projects of varying scope
- Teamwork skills
- Created security tools with some functionality of attack detection; log analysis; web application scanners, or source code analysis tools
