AISB-1052 Application Security Analyst (Technical Controls and DevSecOps)

Abakus IT-Solutions; Namen; Hybride; EUR 60 000 - 90 000; Plein temps

Résumé du poste

Abakus IT-Solutions seeks an AISB-1052 Application Security Analyst focused on technical application security controls and DevSecOps. The role sits in a dedicated security team to replace manual controls with automated, risk-based solutions across the application lifecycle.

You will integrate SAST, DAST, SCA and secrets detection into projects and CI/CD pipelines, evaluate vulnerabilities, and define blocking gates before go-live. Hybrid work with on-site time is expected.

Qualifications

• Experience IT security in an analyst role.
• Experience integrating/operating SAST/DAST/SCA in CI/CD.
• Experience qualifying scan results and prioritising fixes.
• Experience defining quality gates before go-live.
• Experience supporting developers on vulnerabilities.
• Experience following up penetration tests/remediation.

Responsabilités

• Integrate and operate application security tools in projects and CI/CD pipelines.
• Analyse and qualify vulnerabilities: exploitability, impact, false positives and fix prioritisation.
• Define and configure blocking criteria before go-live.
• Contribute to automation of controls in CI/CD pipelines.
• Assess security of application architecture: data flows, auth, encryption, APIs, dependencies.
• Report findings in a technical, documented form.
• Follow up on penetration tests and remediation plans.
• Advise project, development, architecture and operations teams.

Connaissances

Exploitability analysis

Threat prioritisation

DevSecOps

Technical reporting

OWASP Top 10

Secure development

Outils

SAST

DAST

SCA

Secrets detection

Vulnerability scans

Description du poste

AISB-1052 Application Security Analyst (Technical Controls and DevSecOps)

Analyst role focused on technical application security controls, within a dedicated team.

Context and Project

An organisation manages an extensive application estate, including many web applications, built on a wide range of technologies and supplied by various vendors. Poor control of their lifecycle exposes the organisation to service interruptions, data compromise, exploitation of vulnerabilities, growing technical debt and non-compliance with security requirements (NIS2, CyFun).

A dedicated application security team sits within the security department. Its goal is to replace one-off, manual controls with a shared approach that is proportionate to risk, more automated and covers the full application lifecycle.

The team works with project managers, developers, architects, operations teams, functional owners, service centres, DevSecOps and SecOps teams, the SOC, business units and suppliers.

Role and Responsibilities

• Integrate and operate application security tools (SAST, DAST, SCA, secrets detection, vulnerability scans) in projects and CI/CD pipelines.
• Analyse and qualify vulnerabilities: exploitability, impact, false positive filtering and fix prioritisation.
• Define and configure blocking criteria (quality gates) before go-live.
• Contribute to the automation of controls in CI/CD pipelines.
• Assess the security of application architecture: data flows, authentication, authorisation, encryption, APIs and dependencies.
• Report findings in a technical, documented form.
• Take part in the follow-up of penetration tests and remediation plans.
• Advise project, development, architecture and operations teams.

Profile

Education and Experience

• Confirmed experience in IT security, in an analyst role (IT Security Analyst, confirmed level).
• Experience integrating or operating a SAST, DAST, SCA or secrets detection tool in a CI/CD pipeline.
• Experience qualifying scan results, filtering out false positives and prioritising fixes.
• Experience defining a quality gate or blocking criterion before go-live.
• Experience supporting developers in fixing application vulnerabilities.
• Experience following up a penetration test or a remediation plan.

Required Technical Skills

• Vulnerability analysis and qualification: exploitability, impact, false positives and prioritisation: confirmed level.
• Application architecture and security: data flows, authentication, authorisation, encryption, APIs and dependencies: confirmed level.
• CI/CD pipelines and DevSecOps practices: integration, configuration, automation and quality gates: confirmed level.
• Application security tools: SAST, DAST, SCA, secrets detection and vulnerability scans: confirmed level.
• Technical reporting, documentation and support for development teams: confirmed level.
• Technical frameworks: OWASP Top 10, ASVS, SAMM, CWE, CVSS and NIST SSDF: junior level.
• Secure development, APIs, software dependencies, containers and secrets management: junior level.

Location and Conditions

• Working model: hybrid, with on-site presence of 60% of the time or more if needed.