Application Security Engineer (SME) DevSecOps, Pen Testing

We are seeking an experienced Senior Application Security SME/ DevSecOps Security Consultant to lead and mature application security practices across enterprise platforms and development teams. The ideal candidate will have deep expertise in modern application architectures secure coding practices security testing methodologies and the ability to partner effectively with development engineering DevOps and risk teams to embed security throughout the software delivery lifecycle.

• Application Security
  
• Secure SDLC (SSDLC)
  
• DevSecOps
  
• Threat Modeling
  
• Cloud Security (Azure AWS GCP)
  
• Security Architecture
  
• Vulnerability Management
  
• SAST / DAST / SCA
  
• OWASP Top 10
  
• API Security
  

• Act as the Subject Matter Expert (SME) for application security across enterprise platforms and development teams.
  
• Define and enhance the organizations application security strategy standards and control frameworks.
  
• Provide expert guidance on secure design secure coding threat mitigation and vulnerability management.
  
• Partner with engineering and architecture teams to embed security-by-design principles into applications and digital initiatives.
  

• Drive implementation and maturity of the Secure Software Development Lifecycle (SSDLC).
  
• Integrate security controls and testing into CI/CD pipelines and DevSecOps workflows.
  
• Enable use of security tools and automation across build and release processes.
  
• Promote a shift-left security approach to detect and remediate issues early in the development lifecycle.
  

• Perform application architecture and design reviews to identify security risks and recommend remediation strategies.
  
• Lead threat modeling sessions for web mobile API and cloud-native applications.
  
• Review application components for vulnerabilities related to authentication authorization session management input validation data protection and API security.
  
• Recommend secure reference architectures reusable security patterns and implementation guardrails.
  

• Lead or support application security assessments including:
  • Static Application Security Testing (SAST)
    
  • Dynamic Application Security Testing (DAST)
    
  • Software Composition Analysis (SCA)
    
  • API Security Testing
    
  • Manual Security Reviews and Penetration Testing Coordination
    
• Analyze triage and prioritize vulnerabilities based on risk and business impact.
  
• Work closely with development teams to track remediation and validate closure of security issues.
  
• Support secure management of open-source components and third-party libraries.
  

• Provide security guidance for modern application environments including:
  • Microservices and APIs
    
  • Containers and Kubernetes
    
  • Cloud-Native Applications
    
  • Serverless and Event-Driven Architectures
    
• Collaborate with cloud and platform engineering teams to secure application workloads in Azure AWS or GCP.
  

• Ensure application security practices align with internal security policies and external standards and regulations.
  
• Support compliance requirements related to secure development and application security controls.
  
• Contribute to audit responses control evidence collection and security risk assessments.
  
• Develop security metrics dashboards and reporting to track application security posture and control effectiveness.
  

• Bachelors degree in Computer Science Information Security Engineering or related field.
  
• 8 years of experience in Application Security Secure Software Engineering Cybersecurity Architecture or related roles.
  
• Proven experience implementing and managing application security programs in enterprise environments.
  

• Secure SDLC / SSDLC
  
• DevSecOps Principles
  
• OWASP Top 10
  
• API Security Top 10
  
• Common Software and Web Application Vulnerabilities
  

• Checkmarx
  
• Fortify
  
• Veracode
  
• SonarQube
  

• Burp Suite
  
• AppScan
  
• Acunetix
  

• Snyk
  
• Black Duck
  
• Mend / WhiteSource
  

• Experience in Threat Modeling methodologies (e.g. STRIDE).
  
• Strong knowledge of Authentication Authorization Encryption Secrets Management and Secure Design Principles.
  
• Experience working with Cloud Platforms such as Azure AWS or GCP.
  
• Strong verbal and written communication skills with the ability to work across technical and non-technical stakeholders.
  

• Experience in highly regulated industries such as:
  • Banking
    
  • Financial Services
    
  • Insurance (BFSI)
    
  • Healthcare
    
  • Public Sector
    

• NIST
  
• ISO 27001
  
• PCI-DSS
  
• SOC 2
  
• OSFI Guidelines (Canada)
  

• Azure DevOps
  
• Jenkins
  
• GitHub Actions
  
• GitLab
  

• Container Security
  
• Kubernetes Security
  
• Cloud Workload Protection
  
• Red Team / Blue Team Collaboration
  
• Application-Layer Attack Simulation
  
• Security Incident Response Readiness
  

• CISSP
  
• CSSLP
  
• CISM
  
• CEH
  
• GWAPT
  
• OSCP
  
• Azure Security Certifications
  
• AWS Security Certifications
  
• GCP Security Certifications