IT Architect Application Security (Medior)

Rhox; Sint-Gillis; Sur place; EUR 70 000 - 100 000; Plein temps

Résumé du poste

Federal Public Service is launching a secure development programme to embed security across software delivery, aligned with NIS2 and CyFun requirements. You will lead foundations, integrate SCA/SAST/DAST in CI/CD, and map changes to development processes while creating dashboards and standard directives for internal and external projects.

You will collaborate with existing development teams, explain security concepts, and guide training and governance to ensure continuous security improvements

Qualifications

• Background as an application architect with strong security knowledge.
• Proven track record delivering security initiatives at scale.
• At least 3 years reviewing security architectures.
• At least 3 years implementing SCA, SAST and DAST in CI/CD pipelines.
• At least 3 years of DevSecOps experience.
• Knowledge of CyFun and SAMM frameworks.
• Ability to map and document secure development processes clearly.
• Strong communication to technical and non-technical colleagues.

Responsabilités

• Review security architectures and advise on designs, infrastructure and development methods.
• Map process changes and document clear guidance for secure development.
• Embed SCA, SAST and DAST tools in CI/CD pipelines and promote continuous security.
• Build application security dashboards and define routines for ongoing improvement.
• Produce a standard directive for internal projects and external suppliers.
• Create a security matrix to assess externally delivered projects.
• Lead planning, progress reporting, documentation and secure-development training.

Connaissances

Security architecture

Application architecture

DevSecOps

CI/CD security tooling

SCA

SAST

DAST

Agile/Lean SD

CyFun knowledge

SAMM

Security concept communication

Outils

SCA tooling

SAST tooling

DAST tooling

CI/CD tooling

Description du poste

A federal public service is establishing a secure development practice to apply NIS2 and Belgian CyFun requirements in everyday software delivery. You will lead the programme’s foundations, combining security architecture reviews with DevSecOps and security tooling across CI/CD pipelines.

The mission

The work responds to NIS2, in force since October 2024, and the Belgian CyFun framework. Control PR.IP-2 calls for critical systems and components to be developed across the full design cycle, with security-control functions and design and implementation details for security-related interfaces documented. The goal is to integrate secure development into daily procedures, rather than treat compliance as a checklist.

You will work with existing development teams to introduce continuous security practices, using OWASP’s Software Assurance Maturity Model (SAMM) as a reference. You will map changes to development processes, document how teams can apply them, review technical designs, and advise on hardware, software and working methods. The programme also needs application security dashboards, repeatable improvement routines, a standard directive for internal projects and suppliers, and a security matrix for assessing external projects. As project lead, you will plan the work, report progress, document the chosen methods, and may develop and deliver training.

Your responsibilities

• Review security architectures and advise on designs, infrastructure and development methods.
• Map process changes and document clear guidance for secure development.
• Embed SCA, SAST and DAST tools in CI/CD pipelines and promote continuous security.
• Build application security dashboards and define routines for ongoing improvement.
• Produce a standard directive for internal projects and external suppliers.
• Create a security matrix to assess externally delivered projects.
• Lead planning, progress reporting, documentation and secure-development training.

Your profile

Essential skills

• Background as an application architect with strong security knowledge, or as a security architect with strong application-development knowledge.
• Demonstrated experience delivering similar initiatives in an environment of comparable scale.
• At least 3 years of experience reviewing security architectures.
• At least 3 years of experience implementing SCA, SAST and DAST tools in CI/CD pipelines.
• At least 3 years of experience in DevSecOps.
• Knowledge of project management and Agile or Lean Software Development.
• Knowledge of security frameworks, including CyFun and SAMM.
• Knowledge of quality assurance and testing, including test-driven development.
• Ability to map development-process changes and document them clearly.
• Ability to explain and promote security concepts to technical and non-technical colleagues.
• Planning, organisational, leadership and adjustment skills, with a results focus and sense of responsibility.
• Negotiation and relationship-management skills, including the ability to build, lead and supervise a team.

Preferred skills

• Familiarity with OWASP SAMM and CyFun.
• Knowledge of ITIL, Java, Angular, Oracle, Web Services or Service Bus technologies.

Languages

• Dutch: B2
• French: B2
• English: level not specified

Working context

• This is the launch of a secure development programme, so you will help establish its working practices.
• You will support existing development teams and provide guidance covering internal projects and external suppliers.
• The approach centres on SecDevOps, continuous security practices, OWASP SAMM and Agile or Lean methods.
• Project follow-up includes planning and progress meetings, with the selected methods and their implementation documented.