At IBM, work is more than a job - it's a calling: To build. To design. To code. To consult. To think along with clients and sell. To make markets. To invent. To collaborate. Not just to do something better, but to attempt things you've never thought possible. Are you ready to lead in this new era of technology and solve some of the world's most challenging problems? If so, let’s talk.
As an entry level Security Consultant, you'll unleash your exceptional technical prowess to gather and analyze business and technical requirements, skillfully crafting and implementing resilient Enterprise-wide Access Management processes and procedures.
As an esteemed member of our collaborative advisory team, your pivotal contribution will be crucial in establishing comprehensive security measures, ensuring the safeguarding of our clients' invaluable intellectual property and assets.
The security consultant in practice must be a pragmatic management consultant and advisor who can speak to the security landscape and have the ability to communicate effectively with senior members of the client's management and/or executive teams. The consultant should have deep application security knowledge and experience. However, at some level, he/she should also be able to speak to the breadth of the security landscape. The successful candidate will help lead and grow our application security consulting services organization. You will serve as an "application security champion" for the client by establishing and expanding the client's knowledge base in the area of application security.
- Knowledge of how to integrate security testing within the software development life cycle and how to interact with development teams.
- Experience in the use of tools such as Veracode, to analyze source code for vulnerabilities without the need to run the application.
- Handle tools to detect vulnerabilities in running applications.
- Knowledge of analysis methodologies: Know the differences and applications between SAST and DAST, as well as when and how to apply each technique.
- Ability to identify potential vulnerabilities and other security issues at the code level.
- Knowledge in vulnerability management and remediation: use of standards such as CVSS to prioritize vulnerabilities found based on their impact on the business and their likelihood of exploitation and ability to advise developers on how to correct vulnerabilities, suggesting security improvements in the code or application configurations.
- Critical analysis skills: Evaluate SAST and DAST test results, identify false positives and prioritize real threats.
- Ability to investigate problems encountered during security testing and recommend viable solutions.
- Ability to work with developers, testers and architects, communicating security findings clearly and effectively.
- Ability to prepare detailed reports of vulnerabilities found, explaining the technical impact and steps needed to mitigate or correct vulnerabilities.
- Ability to negotiate with development teams to prioritize security fixes based on identified risks.
- Coordination with development, DevOps and security teams to ensure adoption of testing tools and methodologies.