Senior Application Security Analyst

Keystone Solutions; Namen; Sur place; EUR 70 000 - 110 000; Plein temps

Résumé du poste

Keystone Solutions recherche un Analyste Senior en se9curite9 applicative, oriente9 technique et DevSecOps, pour une mission de conseil chez un client. Vous piloterez les contrfles SALM et contribuerez e0 leur inte9gration dans les de9veloppements.

Vous caserrez les priorite9s des vulne9rabilite9s et accompagnerez les de9veloppeurs, architectes et ope9rateurs dans les se9curite9s des applications et des pipelines CI/CD.

Qualifications

• Analyse et qualification des vulne9rabilite9s : exploitrag de9pendant et priorisation des re9solutions
• Architecture et securite9 applicative : flux, authentification, autorisation, chiffrement, API et de9pendances
• Chaeenes CI/CD et pratiques DevSecOps : inte9gration, parame9trage, automatisation et quality gates
• Outils de securite9 applicative : SAST, DAST, SCA, de9tection de secrets et scans de vulne9rabilite9s
• Re9fe9rentiels techniques : OWASP Top 10, ASVS, SAMM, CWE, CVSS et NIST SSDF
• Restitution technique, documentation et accompagnement des e9quipes de de9veloppement
• Se9curite9 du de9veloppement, API, de9pendances logicielles, conteneurs et gestion des secrets

Responsabilités

• Ge9rer les contrfles techniques du SALM et les inte9grer dans le de9veloppement.
• Utiliser les re9sultats des outils pour qualifier les vulne9rabilite9s et contribuer e0 leur reme9diation.
• De9terminer la criticite9 des applications et les contr4c?les appliables.
• Re9aliser analyses des risques et mesures de surveillance selon les me9thodologies.
• De9finir les normes et pratiques de se9curite9 des applications.
• Inte9grer les contrfles de se9curite9 dans DevSecOps/CI-CD (SAST, DAST, SCA, scans et tests).
• Surveiller les exceptions, risques re9siduels et recommandations avant la mise en prod.
• Conseiller les e9quipes projets, de9veloppement, architecture et ope9rations.

Connaissances

Analyse et qualification vulnérabilit

Architecture et securite9 applicative

CI/CD et DevSecOps

Outils de securit applicative

Re9fe9rentiels techniques

Restitution technique et accompagne9

Se9curite9 du de9veloppement, API,

Description du poste

Mission Overview:

Keystone Solutions is seeking a Senior Application Security Analyst with a technical orientation and DevSecOps expertise for a consultancy mission at a client site. The client manages a portfolio of approximately 800 applications, including nearly 400 web applications, utilizing various technologies and providers. A lack of mastery over their lifecycle can lead to significant risks, including service interruptions, data compromises, and increased technical debt.

Key Responsibilities:

• Managing technical controls for Secure Application Lifecycle Management (SALM) and integrating them into development practices.
• Utilizing results from tools to qualify vulnerabilities, assist in their remediation, and contribute to the automation of controls in CI/CD pipelines.
• Determining application criticality and applicable security controls.
• Conducting risk analyses and monitoring measures according to established methodologies.
• Defining application security standards and practices.
• Integrating security controls into DevSecOps/CI/CD projects, including SAST, DAST, SCA, vulnerability scans, and penetration testing.
• Monitoring exceptions, residual risks, and recommendations prior to production deployment.
• Advising project, development, architecture, and operations teams.

Expected Behavioral Skills:

• Technical rigor: reproduce, qualify, and document findings.
• Pragmatism: prioritize exploitable vulnerabilities and propose realistic corrections.
• Pedagogy: explain vulnerabilities and remediations to developers.
• Curiosity: keep knowledge updated on attack techniques and tools.
• Autonomy: configure and operate controls while escalating complex cases.
• Collaboration: work with projects, developers, DevSecOps, SecOps, and providers.

Why Join Keystone Solutions?

• Consultancy Nature: Focus on on-site work and embodying the consultant identity.
• Dynamic Projects: Engage with diverse challenges across various client environments.
• Turbo-Charged Learning: Benefit from professional development and broad learning experiences.
• Skyrocketing Ambition: Enjoy a commitment to career growth within our framework.
• Values: Being a "K-Stone" means bringing our core values to every engagement.

Duration:

04/01/2027 - 03/01/2028 12 months (full time)

Skills required:

• Analyse et qualification des vulnérabilités : exploitabilité, impact, faux positifs et priorisation
• (mandatory) - Level: T3 - Senior - Most recent: Any time
• Architecture et sécurité applicative : flux, authentification, autorisation, chiffrement, API et dépendances
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Chaînes CI/CD et pratiques DevSecOps : intégration, paramétrage, automatisation et quality gates
• (mandatory) - Level: T3 - Senior - Most recent: Any time
• Outils de sécurité applicative : SAST, DAST, SCA, détection de secrets et scans de vulnérabilités
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Référentiels techniques : OWASP Top 10, ASVS, SAMM, CWE, CVSS et NIST SSDF
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Restitution technique, documentation et accompagnement des équipes de développement
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Sécurité du développement, API, dépendances logicielles, conteneurs et gestion des secrets
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time

Language requirements:

French
(mandatory)
Level Proficiency (C2)