Application Security & VIPR Expert

Armis; France; Sur place; EUR 110 000 - 160 000; Plein temps

Résumé du poste

Armis is seeking a hands-on Expert, Application Security & VIPR to architect, automate, and continuously improve the company's application security posture across SaaS and on‑prem platforms.

This role bridges engineering, product security, and vulnerability management, defining how application risks are identified, prioritized, contextualized, and remediated within VIPR, with strong emphasis on cross‑team collaboration and measurable risk reduction.

Qualifications

• 7–10+ years of experience in Application Security, Product Security, or Secure Software Engineering.
• Proven expertise in SAST, DAST, SCA, and dependency management tools.

Responsabilités

• Lead the Application Security program across all Armis products, embedding security throughout the SDLC.
• Own VMDR integration and vulnerability lifecycle from detection through remediation and validation.
• Build automated AppSec pipelines and integrate security testing into CI/CD workflows; mentor teams.

Connaissances

AppSec leadership

Threat modeling

SAST

DAST

SCA

Dependency management

CI/CD security

Vulnerability management

Outils

Veracode

Checkmarx

Fortify

Snyk

SonarQube

OWASP Dependency-Check

Description du poste

The Expert, Application Security & VIPR is a hands-on technical leader responsible for architecting, automating, and continuously improving Armis’ application security posture—while ensuring application vulnerabilities are fully integrated into Armis’ VIPR framework.

This role bridges engineering, product security, and vulnerability management, defining how application risks are identified, prioritized, contextualized, and remediated across Armis’ SaaS and on-prem platforms. You will ensure that AppSec findings are not siloed, but instead correlated with asset intelligence, exploitability, exposure, and business impact.

Key Responsibilities

Application Security Leadership

• Lead the Application Security program across all Armis products, embedding security throughout the SDLC.
• Perform secure design and architecture reviews, partnering with engineering teams to identify and mitigate risk early.
• Conduct and lead threat modeling sessions using STRIDE, DREAD, or PASTA methodologies.

VMDR Integration & Vulnerability Lifecycle

• Own application-layer vulnerability management as part of Armis’ VIPR strategy, from detection through remediation and validation.
• Integrate AppSec findings (SAST, DAST, SCA, API testing) into centralized vulnerability workflows, risk scoring, and prioritization models.
• Correlate application vulnerabilities with asset context, exploit intelligence, and business criticality to drive risk-based remediation.
• Track and report VMDR metrics such as MTTD, MTTR, exposure windows, and remediation effectiveness for application vulnerabilities.

Automation & Tooling

• Build and maintain automated AppSec pipelines for SAST, DAST, SCA, and API security testing.
• Collaborate with DevOps to integrate security scanning into CI/CD pipelines (GitHub Actions, Jenkins, Buildkite).
• Partner with Cloud and Infrastructure Security to secure APIs, microservices, and containerized workloads (Docker, Kubernetes).
• Develop and maintain secure coding standards and security baselines for React, Node.js, Python, Java, and Go.
• Mentor engineers and security champions; deliver secure coding training and threat modeling workshops.
• Act as a trusted advisor to engineering leadership, translating vulnerabilities into clear risk and remediation guidance.

Compliance & Assurance

• Support compliance and audit readiness including SOC 2, ISO 27001, FedRAMP, and HIPAA, ensuring application risks are documented and managed within VIPR /AppSec processes.

Qualifications

• Required Qualifications
• 7–10+ years of experience in Application Security, Product Security, or Secure Software Engineering.
• Proven expertise in SAST, DAST, SCA, and dependency management tools (e.g., Veracode, Checkmarx, Fortify, Snyk, SonarQube, OWASP Dependency-Check).

Preferred Skills

• Experience in a SaaS, cloud-native, or cybersecurity product company.
• Hands-on experience integrating AppSec into broader VIPR or exposure management programs.
• Familiarity with cloud and container security platforms (Prisma Cloud, Wiz, Orca).
• Experience with IaC security (Terraform, CloudFormation).
• Exposure to API Gateway security, OAuth2, token-based auth, and zero-trust architectures.
• Relevant certifications such as OSWE, CSSLP, GWAPT, GWEB, CEH.
• Strong experience managing vulnerabilities end-to-end, including triage, prioritization, remediation tracking, and validation.
• Deep understanding of OWASP Top 10, CWE, CVE, and exploitability concepts.
• Strong knowledge of CI/CD pipelines, Git-based workflows, and secure build automation.
• Experience with threat modeling, secure architecture reviews, and microservices/API security.
• Ability to clearly communicate technical risk to both engineering teams and business stakeholders.