Start your job search

EngineerSenior Engineer IT Application Security

Location: AA Headquarters 1 (DFW-HDQ1)

Additional Locations: None

Requisition ID: 30537

Overview

Join us for a career with endless possibilities.

Looking for a job where a passion for innovation, a culture of teamwork, and opportunities for growth are valued and rewarded? You’ve come to the right place.

You don’t have to be an airline aficionado to join American Airlines. It takes more than cool planes to keep us ahead of the curve, and thanks to our team of behind the scenes professionals, we do just that. As the largest airline in the world, American Airlines is in the business of serving the global travel needs of our customers. At the core of the Company is our commitment to each customer and each employee. We are dedicated to developing and delivering what our customers value and are willing to pay for. Customer-centric planning, innovative marketing, and an exceptional customer experience are supported by a cadre of talented people.

What does it take to join us? We’re glad you asked! We expect exceptional skills in your discipline and a dedication to being the best as we relentlessly pursue our goal of being not just the largest airline in the world, but also the best airline in the world.

Fortunately, we’re building on almost a century of innovation and firsts in our industry – and we plan to continue that tradition of excellence.

About The Job

This job is a member of the Network Tools and Assessment Team, within the Information Technology Division. The Engineer/Sr Engineer , IT Application Security will responsible for identifying critical security risks to the company’s applications and data. This role will allow for effective and efficient targeted remediation of insecure applications/systems and increase security posture and decrease probability of AA data loss/breaches.

Specifically, you’ll do the following:

* Uses Static and Dynamic Analysis tools to support broad testing and vulnerability discovery.

* Evaluates applications for security flaws by performing fuzzing, access/authorization bypass, business logic abuse and intentional fault injection.

* Reviews application architectures and implementation details for design flaws, incorrect security implementation and missing security controls.

* Works with other security team members to research and test for complex security issues.

* Consults with Software Engineers, Infrastructure Architects and Security Architects to correct application, architectural or environment flaws.

* Validates external security researcher bug bounty submissions.

* Works closely with service providers and external security support resources to schedule, track and manage security testing efforts.

* Creates and/or maintains threat models to communicate risks to engineers, project managers and other technical personnel.

About The Job (Continued)

* Ensures applications are built according to enterprise security standards.

* Works with development teams to review application source code for security and operational risks.

* Performs manual code reviews of applications that are not compatible with automated SAST tools.

* Provides detailed security documentation to developers, software engineers and technical personnel when necessary.

* Provides guidance and recommendation to software architects and engineers on how to correct code related security flaws.

* Participates in peer reviews of security assessments created by other team members.

* Maintains the enterprise SSDLC standard.

Qualifications

Required Qualifications

* Bachelor’s degree in Computer Science, Computer Engineering, Technology, Information Systems (CIS/MIS), Engineering or related technical discipline, or equivalent experience/training

* 2 years of experience working as a frontend or backend software developer

* Experience as a developer on a team consisting of five or more software developers

* Expert level knowledge of at least one compiled programming language

* Expert level knowledge of at least one interpreted programming language

* Ability to write a software specification

* Ability to conduct independent research

* Broad understanding of web service implementation paradigms (REST, SOAP)

* Familiarity with OWASP and the San’s Top 25

* Basic understanding of Cryptography concepts: hashing, signing, symmetric/asymmetric encryption and decryption

* Basic understanding of network security concepts: DOS, DNS Spoofing, ARP Poisoning, Reverse Shells, Firewalls,

* Basic understanding of defensive programming and test-driven development

* Knows how to perform common application exploits: XSS, SQL Injection, UI Redressing, Directory Browsing, Log Forging

* Basic understanding microservice application architecture, software cohesion and software coupling

* Comfortable learning new programming languages as needed to conduct code reviews

* Comfortable with the following tools and technologies: Git, SoapUI, Jenkins, Artifactory, SonarQube, FindBugs, Docker, Coverity

Qualifications (Continued)

Preferred Qualifications

* Expert level knowledge static analysis tools and methods

* Expert level knowledge of dynamic analysis tools and methods

* Advanced knowledge software engineering concepts: design principles and design methods (Scrum, XP, Lean, Waterfall)

* Strong understanding of common cryptographic algorithms and libraries

* Experience with mobile application development on Android or iOS

* 2+ years working as full stack software developer

* 1+ years working in a software QA role.

* Ability to effectively communicate both verbally and written with all levels within the organization

* Ability to effectively explain technical concepts and adjust messaging based on the audience

* Ability to influence through outstanding interpersonal skills, collaboration, and negotiation skills

* Ability to work well within a team environment, as well as independently

Additional Locations: None

Requisition ID: 30537

Nearest Major Market: Fort Worth

Nearest Secondary Market: Dallas

Job Segment:
Application Engineering, Engineer, Information Systems, Developer, Computer Science, Engineering, Technology

I would like to apply for the post of EngineerSenior Engineer IT Application Security bases at your esteemed organisation. I have attached my CV.

CV:

I agree to Terms and conditions* and Privacy Policy* and Site Usage Policy*

I don‘t want to receive regular notifications (in a form of newsletters) on new/featured Job Listings sent to my e-mail.