Application Security Specialist (L3) SSDLC Operations

Role Title

Application Security Specialist (L3) SSDLC Operations

Operational hours

24 7

Role Purpose

Own operational SSDLC for 180 in-house apps + 900 third party/SaaS, drive adoption of Client SSDLC processes/tools, integrate security in Agile/DevOps/CI CD, coordinate remediation, and deliver pre release security reviews and monthly reporting.

Key Responsibilities

Drive SSDLC adoption across design build test release operate
Conduct security reviews before release and enforce gates
Integrate SAST/SCA/Secrets (Checkmarx, GitHub AS) and ASPM (Apiiro) into CI/CD (GitHub Actions/PR checks)
Coordinate DAST enablement with DAST Ops; ensure pipelines block on critical findings
Triage findings; create Jira remediation workflows; track SLA fixes and escalate delays
Maintain vulnerability dashboards  (Jira/Confluence, Apiiro)
Provide developer training and Security Champions enablement
Perform security assessments of third party/SaaS  apps

Required Skills & Experience

8 ot 10 years in AppSec/SSDLC operations; hands on with Apiiro, GitHub Advanced Security (CodeQL, secrets), Checkmarx, Jira/Confluence; strong CI/CD experience (GitHub Actions), SAST/SCA/DAST pipelines; vendor coordination; ability to coach developers (Java/.NET/JS/Python).

Shift Coverage

24 7 roster; L2/L3 on-call for P1 release blockers and urgent findings; formal handovers.

Systems Access & Request Process

Apiiro: Project Admin via Jira/ServiceNow AppSec Manager approval Platform owner grant quarterly recert. GitHub AS: Repo security settings via DevTools; approvals by Repo Owner + AppSec. Checkmarx: Project Admin; license tracked in Confluence; AppSec Manager approval. Jira/Confluence: Project + dashboard permissions via group; AppSec approval. SD Elements: Analyst/Admin (limited to leads).

Primary Tools

Apiiro ASPM, GitHub Advanced Security (CodeQL, Secret scanning, Dependabot), Checkmarx, SD Elements, Jira/Confluence, GitHub Actions.

Keywords

Application Security,  Secure SDLC, DevSecOps, ASPM, Apiiro, GitHub Advanced Security, CodeQL, Secret Scanning, Dependabot, Checkmarx, SD Elements, SAST, SCA, DAST, CI/CD Security, GitHub Actions, Pull Request Security, Pre-release Security Reviews, Security Gates, Vulnerability Management, Vulnerability Triage, Remediation Coordination, SLA Management, Third-Party Security, SaaS Security Assessment, Secure Code Review, Developer Training, Security Champions, Agile, DevOps, Jira, Confluence, 24 7 Operations, L2/L3 Support, Release Blockers, P1 Vulnerabilities, Java, .NET, JavaScript, Python, Senior AppSec