Application Security / DevSecOps Specialist

Responsibilities

• Application Security and Secure Development
• Taking part in building, rolling out and continuously developing the Bank's Application Security, Secure SDLC and DevSecOps processes, including shaping the technical controls, tools, integrations and workflows needed.
• Taking part in designing and rolling out the Secure Software Development Lifecycle (Secure SDLC) process, embedding information security requirements across the whole software development lifecycle — Requirements
• Design, Development, Testing, Deployment and Maintenance phases.
• Carrying out security assessments of the Bank's new and existing web applications, APIs, backend/frontend components and other software solutions.
• Carrying out source code security review, to find security vulnerabilities, unsafe programming approaches, misconfigurations and other security problems in the code.
• Running and developing SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), SCA (Software Composition Analysis), secret scanning and other Application Security checks.
• Analysing the results of SAST, DAST, SCA and other AppSec tools, and carrying out triage and validation to tell real vulnerabilities from false positives.
• Classifying the Application Security vulnerabilities found and setting their priority, taking into account severity, exploitability, application criticality, data sensitivity and the possible business impact.
• Handing the vulnerabilities found to the relevant development teams, tracking their remediation and carrying out retest / verification.

Languages