IT Security Engineer

Business Unit Overview:

Working as Full-Time IT Security Engineer you will be responsible for testing, designing and implementing security controls and solutions driven by policies and standards to reduce the risk to Fastenal and its customers.

Responsibilities:

The duties and responsibilities of this position include, but are not limited to:

• Performing Vulnerability Assessment and Penetration Testing (VAPT) for Web and Mobile applications
• Perform Static Application Security Testing (SAST) using source-code security scanning tools.
• Perform Software Composition Analysis (SCA) to identify vulnerable, outdated, or unsupported third-party libraries and dependencies.
• Validate security remediation through manual testing, automated rescans.
• Review and correlate application security findings across multiple security tools and ensure appropriate risk assessment, prioritization, and remediation.
• Assess application security tooling effectiveness, identify coverage gaps, and recommend improvements to the Application Security / Product Security program.
• Track application security vulnerabilities through remediation and ensure identified issues are addressed within defined timelines.
• Assisting SOC team for Security Operations and Incident Response
• Engineering, implementing and monitoring security measures for the protection of computer systems, networks, and information
• Engineering, implementing, and monitoring long-term retention of security relevant data collection and storage
• Monitoring security analytics and investigating anomalies
• Configuring and troubleshooting security infrastructure software and devices
• Designing, implementing and maintaining controls around sensitive data (PCI, SOX, HIPAA, etc)
• Providing 12x7 support on critical systems in an on-call rotation

Required Position Qualifications:

The following skills and qualifications are required for this position:

• Possess a degree in Information Technology, Computer Science and have at least 5 years of relevant experience in the areas of information security
• Having at least 3 years of relevant experience in Vulnerability Assessment and Penetration Testing (VAPT)
• Demonstrated knowledge of problem solving, planning, and continuous improvement methods
• Excellent written and oral communication skills
• Highly motivated, self-directed and customer service oriented
• Demonstrate strong math aptitude, attention to detail and sense of urgency
• Work independently as well as in a team environment
• Demonstrate our core values of ambition, innovation, integrity and teamwork

Preferred Position Qualifications:

• Certification as OSCP, CompTIA Pentest+, GWAPT, BSCP, CEH, OSWE
• Handson experience with INVICTI, BurpSuite, Coverity, SonarQube, Github CodeQL, Corellium, Microsoft Azure Cloud Security, Web Application Firewall (WAF), Tenable and RiskSense
• Prior experience in the development and delivery of information security concepts to technical and non-technical partners through training and awareness programs
• Knowledge of data protection policies, procedures and products (Privacy rules and regulations, data security, encryption, digital rights management, Data Loss Prevention)