Qa Automation Engineer (Security)

theScore, a wholly-owned subsidiary of PENN Entertainment , empowers millions of sports fans through its digital media and sports betting products. Its media app ‘theScore’ is one of the most popular in North America, delivering fans highly personalized live scores, news, stats, and betting information from their favorite teams, leagues, and players. theScore’s sports betting app ‘theScore Bet Sportsbook & Casino’ delivers an immersive and holistic mobile sports betting and iCasino experience. theScore Bet is currently live in the Company's home province of Ontario. theScore also creates and distributes innovative digital content through its web, social and esports platforms.
About The Role & Team
As a QA Automation Engineer (Security), you’ll work with theScore’s security operations, core and client engineering teams to help them validate several customer-facing & operator-facing Mobile & Web products and ultimately help maintain compliance, audit and security standards. In addition, you will be involved in the day-to-day Automation activities and assist with the QA testing effort during our release cycles. The ideal candidate has strong communications skills, attention to detail, up-to-date knowledge of security principles and a solid background in security testing approaches for mobile apps (iOS & Android) and web apps. An interest in professional sports & betting is a plus.
About The Work

• Define, maintain, and execute security testing checklists on weekly product releases.
• Work with various teams to continuously enhance and meaningfully contribute to test strategies, test automation, integration testing and threat modeling.
• Contribute to scripting automated security checks and pipelines.
• Conduct vulnerability assessments, penetration testing, and reverse engineering attacks on backend and frontend platforms.
• Research emerging cybersecurity trends, threats, and technologies and perform proof of concepts in collaboration with various stakeholders.
• Create security test plans and test cases; utilize verification techniques for validating fixes and mitigating risk.
• Review and analyze security policies, systems, and processes to identify areas for improvement.
• Other duties as required.
• Steer and support the product integrity through solid documentation and development of security testing suites and processes.
• Become a product expert to ensure the security tests and frameworks align with our delivery & compliance methodologies.
• Investigate test failures using static and dynamic security analysis tools and follow through from triage to resolution.

About You

• Able to precisely target clients versus backend, and able to perform passive scans versus active attacks in collaboration with relevant product owners and stakeholders.
• Experience with tampering & penetration testing and risk assessment.
• Up to date knowledge on the latest exploits for various platforms, eg: magisk, unc0ver, CWE, CISA, CVD, NVD, etc.
• Degree in computer science/engineering or equivalent knowledge and/or experience.
• Experience using version control (Git), defect tracking systems (JIRA), and test case management & specifications (TestRail, Cucumber).
• Ability to handle multiple projects simultaneously & to work independently or as part of a team while prioritizing daily tasks.
• Experience with CLI scripting of some of the above tools or other industry-specific applications.
• Experience with application security methodologies and common vulnerability testing.
• Experience with Android device rooting and iOS device jailbreaking.
• Able to flash ROMs & restore Android & iOS devices to factory settings.
• Able to use automated scanning tools & systems to produce reports detailing severity of vulnerabilities found.
• Excellent written and verbal communication skills.

Main Tools Used & Preferred

• Test Management: TestRail, Cucumber.
• Saucelabs, Browserstack, Circle CI, App Center, and Github.
• Javascript & HTML, linux, python, and bash scripting.
• REST & GraphQL API testing: REST-assured, okhttp, k6.io, etc.
• Web/HTTP Proxy tools such as Charles Proxy & chrome dev tools + plugins.
• Jenkins, groovy, bash, jenkins job builder (yaml).
• Web & Network security: OWASP, burpsuite, nmap, wireshark, metasploit, kali, etc.
• Jira, Confluence, GSuite, Slack.
• Reverse Engineering: Android SDK tools, Xcode, APK Lab, frida, etc.

What We Offer

• Competitive compensation package.
• Education and conference reimbursements.
• Opportunities for career progression and mentoring others.
• Parental leave top up.

theScore is committed to creating a diverse environment and is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability or age.