Application Security Engineer

? Overall, in charge of managing and improving existing Paynamics Internal Applications and its
interaction to Paynamics Stakeholders. (i.e. Clients, Business Units, Execom)
? Conducts and improves project application security risk and threat assessment process to identify the security
posture of the project.
? Runs vulnerability scan, penetration testing, and exploit code execution for systems to ensure that the security
of the application that will be deployed in the live environment meets the global standards. Update the
information security workbook for the newly identified vulnerabilities.
? Performs security assessment, and reviews architecture and design patterns on mobile projects and APIs
(Application Program Interface) to secure the applications from malicious threat actors.
? Analyzes results of reconnaissance, automated scan, and penetration testing to document and identify
vulnerabilities and remediations. Verify if there is a CVE value for the identified vulnerabilities.
? Recommends technical solutions to the vulnerabilities identified during assessment and reviews the accuracy
of the recommended remediation by the security specialist.
? Reviews the application libraries or components by applying in-depth methods of application security to identify
the potential security flaws of the project.
? Conducts Static Application Security Testing (SAST) to identify the attack vectors in the source code, and
recommends remediations to prevent exploitation by threat actors. Assess the viability of the SAST tool
quarterly and recommend it if needed.
? Researches new security technologies from various platforms and presents the research findings to the team
for Information Security Summit Topics.
? Attends, documents and coordinates project kick-offs with the software development team to provide feedback
on the potential concerns that may be encountered in the project development.
? Facilitates information security training to educate the users to protect the company data against threat actors.