ApplSec DevSecOps - DAST Professional

Level

L-1

• Analyze results from Fortify WebInspect scans
• Perform manual verification for reported vulnerabilities
• Maintain scan health monitoring, schedule adherence, and successful completion
• Document and share validated results and reports within SLA
• Drive remediation status tracking and escalate when needed
• Participate in continuous improvement of scanning logic and tool performance.

L-2

• Configure and manage DAST scans using Fortify WebInspect across CI/CD and ad hoc needs
• Maintain scan authentication settings, schedules, and scan success
• Manual exploit validation of findings reported
• Security assessments of the threat scenarios and abuse cases
• Assess business workflows and critical business transactions manually for business logic bypass scenarios
• Triage scan results, validate with manual exploit testing where needed
• Prepare and share structured scan report
• Findings discussion with application teams and business teams
• Review critical vulnerabilities with all required stakeholders and support timely remediation
• Ensure SLAs for testing and reporting are met
• Track DAST scan failures and coordinate resolution with OEM support
• Document findings and participate in risk analysis and abuse case testing
• DAST tool utilization and feature implementation analysis.

L-3

• Lead threat modeling and manual validation of Fortify WebInspect findings
• Perform manual security testing to cover business logic and abuse cases
• Provide second-level triage of critical/high-risk vulnerabilities
• Conduct DAST tool coverage reviews and feature utilization evaluations
• Second level AppSec reports/findings discussions with application stakeholders for critical issues, false positives, exceptions, etc.
• Guide application teams in remediation planning and secure design discussions
• Ensure DAST testing and report delivery within SLA, and track metrics
• Mentor analysts and contribute to security automation opportunities.

Tools / Technology -

MicroFocus Web Inspect, Burpsuite, Postman, SOAP UI, Open Source Mobile and Web App Pentetrating Testing Tools.