MCGLADREY & PULLEN LLP RSM US LLP Risk Consulting Web Application Tester in DES MOINES, Iowa

In order to address the most critical needs of our clients, RSM US LLP has established the Security and Privacy Risk Consulting group, comprised of more than 150 professionals dedicated exclusively to serving the cyber security needs of our clients. This group includes experienced consultants located throughout the country dedicated to helping clients with preventing, detecting, and responding to security threats that may affect their critical systems and data. We serve a diverse client base within a variety of industries, and we are relied upon to provide expertise within areas of security testing, architecture, governance, compliance, and digital forensics.We are seeking individuals skilled at performing vulnerability assessments, penetration testing, secure code reviews, and secure architecture reviews of web applications and their related infrastructure.Responsibilities will be based on background but will typically include:Perform analysis and testing to verify the strengths and weaknesses of Web Applications and Web Services (SML, SOAP, WSDL, UDDI, etc.) utilizing commercial and open source security testing toolsPerform Internet penetration testing (blackbox/greybox /whitebox testing) and code reviews (manual/automated) of web applications and related infrastructurePerform automated and manual reviews of the underlying code of web applications in regards to common security weaknessesAssist with the development of remediation recommendations for identified findingsIdentify and clearly articulate (written and verbal) findings to senior management and clients. Help identify improvement opportunities for assigned clients Supervise and provide engagement management for other staff working on assigned engagementsBasic Qualifications:This position is for individuals with 1-6 years of experience within the cyber security space, with a preference for prior consulting or professional services backgrounds. Other candidates may be considered based on experience and skill setsAbility to travel as neededMust possess a high degree of integrity and confidentiality, as well as the ability to adhere to both company policies and best practicesStrong verbal and written abilitiesStrong multitasking and project management skillsPreferred Qualifications:Bachelor's degree in computer science or related field from an accredited college/universityTechnical background in web application development, architecture, assessment or related fieldsExperience with testing and development frameworks such as the Open Web Application Security Project (OWASP), Open Source Security Testing Methodology Manual (OSSTMM), the Penetration Testing Execution Standard (PTES)Operating System Configuration and Security experience (Windows, HP-UX, Linux, Solaris, AIX, etc.)Configuration and Security experience with Web Servers and Web Applications (Apache HTTP/Tomcat, Microsoft IIS, Sun One, Oracle iPlanet, IBM WebSphere, etc.)Database Configuration and Security experience (MySQL, Microsoft SQL, IBM DB2, Sybase, Oracle, etc.)Web Service experience (XML, SOAP, WSDL, UDDI, etc.)Experience with discovering and demonstrating web application vulnerabilities such as Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Injection Flaws, Remote file inclusion (RFI) and SQL InjectionCommercial Application Security tools experience (AppScan, WebInspect, Acunetix, etc.)Web Proxy tools experience (Achilles, Webscarab, Burp, Spike, Paros, etc.)One or more of the following technical certifications: Sun Certified Java Developer (SCJD); Microsoft Certified Solution Developer (MCSD) for .NET; Certified Ethical Hacker (CEH); GIAC Certified Penetration Tester (GPEN); Offensive Security Certified Professional (OSCP); GIAC Web Application Security (GWAS);or equivalent development or testing certification (ECSA, CEPT, CPTE, CPTS, etc.)In addition, one or more of the following governance certifications is preferred: Certified Information Systems Security Professionals (CISSP); Certif