Application Security Professional

Position Purpose

ResponsibilitiesDirect Responsibilities

• Strong expertise in application security concepts and activities like Source Code Review (SAST) & Dynamic application vulnerability scanning (DAST).
• Good understanding of Information Security concepts and strategies.
• Knowledge of Secure Development methodologies and frameworks.
• Hands-on experience in penetration testing and tools like Apisan, WebInspect, Fortify, AppSpider, BurpSuite, Qualys, Checkmarx, Coverity
• Well-versed in conducting Security Review, Assessments and providing recommendations.
• Knowledge of OWASP, SANS standards.
• Executing IT risk assessment reviews, identifying controls gaps and working in collaboration with subject matter experts to devise appropriate mitigation plans.
• Experience in Process Improvement, Controls Enhancement and Reporting.
• Identifying key risk trends, issues and other insights requiring further investigation and following up with Technology as appropriate.
• Providing independent expert advice to the IT areas on application & data risk issues.
• Engaging with organization wide risk and control groups, including internal audit and territory control teams.
• Working with Technology stakeholders (including Production Support and Development teams) to identify the IT risks affecting the organization and formulate appropriate remediation strategies based on a full understanding of business exposure and compensating controls.

Contributing Responsibilities

• Monitoring and oversight of existing IT risks, working collaboratively with stakeholders in ensuring plans are managed within timescales and escalating where appropriate.
• Managing relationships with Business and IT teams, chairing periodic meetings and being a point of contact for escalating to wider team members.
• Assistance with drafting of risk acceptance statements and coordinating sign-off from business and IT stakeholders.
• SPOC for security architecture meetings.

Technical & Behavioral Competencies

• Excellent Interpersonal and presentation skills
• Strong in verbal and written communication
• Ability to liaise with cross-functional stakeholders globally
• Clear understanding of application and data security
• Must be flexible, independent, self-motivated
• Good analytical skills.

Specific Qualifications (if required)

• CEH, SSCP, OSCP certified.
• Technical Graduate (Computer Science) Preferable.