Application Security Engineer

Application Security Engineer

Commitment:

6-months

Role Overview:

This role is responsible for finding and fixing security defects in the code of the Treetracker APIs, web apps, and mobile app. The Application Security Engineer will work through pull requests with the maintainers of each repository and add a test for each fix.

Compensation:

Volunteer, until otherwise funded

Reports to:

Cloud Lead

Collaborates with:

Sr. Engineer, VP Engineering and Software Engineers

AREAS of RESPONSIBILITY

This role is responsible for ensuring the security of Greenstand’s application code, dependencies, and build workflows.

• Identify and fix security defects in the Treetracker APIs, web apps and mobile app
• Ensure public APIs and web pages expose only the data they need
• Verify that authorization checks are correct in the admin API and admin client
• Secure GitHub Actions workflows and handling of secrets in code and logs
• Keep dependencies up to date, with priority on reachable code
• Ensure every fix is submitted through a pull request with an accompanying test

REQUIRED TASKS

• Reviewing and fixing database query code in Node.js APIs (Express, Knex, PostgresSQL, PostGIS)
• Reviewing public APIs and web pages to confirm they return only necessary data
• Reviewing authorization checks in the admin API and the admin client
• Hardening GitHub Actions workflows: pinned actions, least token permissions, and safe handling of pull requests from forks
• Removing secrets from code and logs, and helping the maintainers rotate them
• Triaging Dependabot alerts and updating dependencies, with priority on reachable code
• Reviewing the security configuration of the Android app
• Reviewing fix pull requests from other contributors

QUALIFICATIONS/EXPERIENCE/KNOWLEDGE:

• 3 or more years of backend work with Node.js or TypeScript
• Good knowledge of SQL and PostgreSQL
• Secure code review experience, and knowledge of the OWASP Top 10
• Experience with automated tests and a pull request workflow on GitHub
• Discretion with sensitive information
• Experience with Next.js and React is a bonus but not required
• Android experience (Kotlin or Java) is a bonus but not required
• Knowledge of OAuth 2.0, OpenID Connect, or Keycloak is a bonus but not required
• Python experience is a bonus but not required

Thank you for your interest in volunteering with Greenstand and for expressing your willingness to contribute as a product designer. We truly appreciate your enthusiasm for our cause and your desire to make a difference.As a volunteer, you'll have the opportunity to work closely with our team, gain valuable experience, and make a positive impact on the environment.

Next Steps...

Step 1: Complete Our Volunteer Registration Form: Tell us about your skills, goals, and volunteer expectations. - https://docs.google.com/forms/d/e/1FAIpQLSeEmwekGZ5tcc5sVhsgMDf-KEDBMtZYoCYAmxyxrOPv5w0WKA/viewform

Step 2: Join Greenstand Slack: Introduce yourself in the #community-intros channel and indicate the specific role you are interested in. We can’t wait to meet you! - https://join.slack.com/t/greenstand/shared_invite/zt-403l6k278-r_xHa8hfmgTtV1spTxWeNA