Application Security Specialist II — DevSecOps & Automation

Convergys; Bogotá ciudad; Híbrido; COP 78.120.000 - 122.760.000; Jornada completa

Descripción de la vacante

Concentrix in Bogotá seeks a Specialist II, Application Security to strengthen security across the software development lifecycle. You will collaborate with Security, DevOps, and Development teams to embed secure coding practices and automate security testing across pipelines.

The role focuses on DevSecOps maturity, integrating security tools (SAST, DAST, SCA), API security, and vulnerability remediation, while aligning with OWASP and NIST standards. Strong cross-functional teamwork is essential.

Formación

• Experience or working knowledge in application security, DevSecOps, secure SDLC practices, or related security functions.
• Understanding of secure coding practices and common application security risks.
• Familiarity with security testing tools and approaches, including SAST, DAST, and SCA.
• Knowledge of API security concepts, including authentication, authorization, rate limiting, access control, and sensitive data exposure.
• Experience supporting vulnerability management activities, including tracking, prioritization, remediation coordination, and reporting.
• Ability to collaborate with Development, DevOps, and Security teams in a cross-functional environment.
• Familiarity with CI/CD pipelines and the integration of automated security testing into development workflows.
• Understanding of external exposure management, internet-facing application risks, and attack surface monitoring.
• Knowledge of OWASP and NIST standards.

Responsabilidades

• Serve as a key bridge between Security, DevOps, and Development teams to embed security throughout the SDLC.
• Partner with application developers to promote secure coding practices, identify security gaps, and recommend effective remediation.
• Provide training and guidance to developers on secure coding standards, application security risks, and security tools within CI/CD pipelines.
• Support and enhance DevSecOps practices with a focus on automated security testing across development workflows.
• Integrate and maintain security tools, including SAST, DAST, and SCA, within CI/CD pipelines.
• Drive automation initiatives for application security assessments, including API security testing for authentication, authorization, rate limiting, sensitive data exposure, and access control.
• Support external exposure management, including internet-facing asset discovery, attack surface monitoring, and vulnerability identification.
• Monitor and manage risks related to internet-facing applications, including MFA, SSO, and exposure risks.
• Track, prioritize, and support remediation of vulnerabilities identified through SAST, DAST, SCA, API testing, and external scanning.
• Report on vulnerability remediation progress and help ensure findings are closed within defined timelines.
• Collaborate with cross-functional teams on root cause analysis, security control improvements, and continuous application security enhancements.
• Maintain documentation related to security findings, remediation actions, automation improvements, and DevSecOps pipeline updates.
• Ensure application security practices align with organizational policies and industry standards, including OWASP and NIST.
• Complete all assigned, mandatory training within the timeframe provided.
• Conduct and/or participate in regularly scheduled 1:1 meetings with your direct manager and/or direct reports.

Conocimientos

Application security

DevSecOps

Secure SDLC

SAST

DAST

SCA

CI/CD

APIs security

Vulnerability management

OWASP

NIST

Documentation

Herramientas

SAST tools

DAST tools

SCA tools

CI/CD tooling

Descripción del empleo

Concentrix in Bogotá seeks a Specialist II, Application Security to strengthen security across the software development lifecycle. You will collaborate with Security, DevOps, and Development teams to embed secure coding practices and automate security testing across pipelines.

The role focuses on DevSecOps maturity, integrating security tools (SAST, DAST, SCA), API security, and vulnerability remediation, while aligning with OWASP and NIST standards. Strong cross-functional teamwork is essential.