The main focus of a source code auditor is to look for any security weaknesses that may exist in a source code or any bugs that are there. Also, if there are any violations of programming conventions, this should be discovered by a source code auditor. This job is in fact analogous to being a needle which attracts all the pieces of code that may potentially reveal important information about the internal system or database of an organization to potential hackers. Also, a source code auditor should be responsible for looking for any law violations of licenses which govern a particular open source project.

Making use of automated security tools that scan for vulnerabilities is really advisable. Nonetheless, such tools may become fooled or may just overlook some existing weaknesses in a programming project. Accordingly, there is still a huge need for manual code review conducted by a source code auditor. Responsibilities of the job could be summarized through the following points:

• A source code auditor should help the development team to prepare code for the auditing process.
• She should always have a close look at the source code without skipping a line in order to search for potential weaknesses.
• She should also make sure that the basic notions of security are satisfied by the source code through reviewing all the authentication, authorization, session and communication mechanisms.
• She is also expected to get involved in some penetration testing in order to order the detected weaknesses and categorize them into high risk ones and low risk ones on the other hand.
• After doing the investigations, a source code auditor should be able to identify all the spots of the code where sensible information could get leaked through. This will help a lot with preventing any unauthorized access to take place.
• She should be really aware of the legalizations of commercial and open source licensing like intellectual property law for example.
• Any third-party libraries should be reviewed for security leaks by a source code auditor whether such libraries are open source or commercial ones.
• She should submit a comprehensive document containing all the results of the conducted investigations to both development team and legal team as well.
• The role of the source code auditor does not just stop at submitting any discovered code weaknesses, security leaks, or law violations. However, she is also responsible for providing a list of actions to be adopted by both the legal and development teams in order to solve all the found problems.
• A source code auditor should also be able to educate the development teams and hold trainings for them to point out some security concepts for them to consider when developing any future pieces of code.

It is also worth noting that most of the time, a source code auditor is in fact an independent consultant who is hired for the short term to discover any security leaks in a developed piece of code rather than having her on staff within the organization.

Career paths to the source code auditor job is essentially dependent on the individual interested in the job in the first place. There are many intellectuals who first work in the field of software or web application programming then begin to specialize in the source code auditing path along the way. There are some other intellectuals who start satisfying their passion when they are in university such that they begin to focus on the security aspects when developing code during their university years and start the auditing path from there.

A source code auditor may just take part in different other roles rather than merely auditing. Some of the hats that a source code auditor may wear along the way are:

• Penetration Tester
• Vulnerability Assessor
• Forensics Expert
• And of-course she is covered under the umbrella of a Security Consultant job.