At a Glance
About This Role
Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!
Responsibilities
In this position, you will primarily be researching and implementing detections for vulnerabilities on all the latest web application technologies. You will also be expected to fine-tune existing logic and payloads to detect vulnerabilities and CVEs with zero false positives for the Qualys Web Application Security product. Efficient problem-solving and troubleshooting skills are necessary, as well as using the latest tools in the industry.
Required Skills:
* 4-8 years of industry experience in web application security
* Create exploits, proof-of-concept for web application vulnerabilities
* Strong JavaScript programming skills
* Knowledge of HTTP protocol (Requests, responses, Cookies, etc.)
* Understanding of web application vulnerabilities, OWASP Top 10 in Web Applications, API, and LLMs
* Exposure to DAST/BlackBox tools
* Web application security scanning tools like BURP/ZAP, SQLMap, CURL
* Experience with network analysis tools and analysis of packet captures.
* Proficient with regular expressions.
* System administrator experience on Windows or Unix platforms.
* Strong analytical and problem-solving skills
* Passion for web security and attention to detail
* Experience with scripting languages, including Python and Bash
* Exposure to JAVA programming
* Experience with Selenium, Postman scripting
* Experience with Metasploit/Nessus exploits (especially HTTP-related )
* Experience with web application firewalls (WAF) rules, ModSecurity
* Exposure to WEB 2.0, XML/XPath, JSON, Swagger
* Database/SQL knowledge
* Experienced in the use of various scanners and open-source security tools.
* Experience in developing security-related tools/programs.
* Ability to work independently
* Published research
* Security certifications
Education
Bachelor’s / Master’s degree in Computer Science, Engineering, or equivalent practical experience
Source: Qualys careers · View original posting
About Qualys
Qualys, Inc. is an American technology company based in Foster City, California, specializing in cloud-based security and compliance solutions. Founded in 1999, Qualys is recognized as a pioneer in software-as-a-service (SaaS) security, launching its flagship product, QualysGuard, in 2000. The company provides a unified cloud platform that delivers continuous security and compliance intelligence across various IT environments, including on-premises, cloud, and mobile devices. Qualys offers a comprehensive suite of services through its Qualys Cloud Platform, which includes Vulnerability Management, Asset Discovery, Cloud and Container Security, Web Application Security, Compliance Management, and more. The company serves over 10,000 subscription customers globally, including many from the Forbes Global 50, 500, and 2000. With strategic partnerships with major cloud providers and consulting firms, Qualys is positioned as a leading provider in unified cloud security and compliance, helping organizations protect their digital assets and meet regulatory requirements.
Security at Qualys
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
Security Philosophy
- Qualys' AppSec philosophy emphasizes embedding security early and continuously in the development lifecycle, fostering DevSecOps collaboration, and automating remediation without slowing down development.
- They focus on risk-based prioritization, using TruRisk™ to quantify impact based on exploit likelihood, data sensitivity, and asset value.
- Goals include simplifying remediation and bridging the gap between development and security through no-code automation.
Security Team
Information regarding Qualys' AppSec team organizational structure, reporting lines, team size estimates, and common skill/tool patterns from active job postings is not publicly available. However, a job posting indicates a "Vice President, Product Management – CNAPP, AppSec and AI Security"role, suggesting leadership in these areas.
Key Initiatives
- Qualys' AppSec initiatives include a strong focus on "Shift Left"practices, embedding security early and continuously through native integrations with CI/CD pipelines like GitHub Actions, Azure DevOps, and Jenkins.
- Their vulnerability management process involves auto-discovery of APIs and web applications, simplifying remediation with risk-based prioritization, and automating ticket creation in ServiceNow and Jira.
- A significant recent initiative is the upcoming Qualys TotalAppSec, expected in Q1 2025, which will integrate API security, web application scanning, and AI-driven malware detection.
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
Interested in this role?
Apply on Qualys's site