Application Security Engineer / DevSecOps Specialist

Core-Asset Consulting Ltd; Newcastle upon Tyne; On-site; GBP 70,000 - 95,000; Full time

Job summary

Core-Asset Consulting Ltd is seeking an Application Security Engineer to embed security into the software development life cycle, acting as SME in application and cloud security and guiding secure design and vulnerability remediation.

You will work with developers in Azure environments, perform SAST/DAST, threat modeling, and help define secure coding standards while integrating security tooling into CI/CD pipelines.

Qualifications

• Experience securing applications in cloud environments, ideally Azure.
• Strong understanding of OWASP vulnerabilities.
• Software development experience ideally with C# / .NET.
• Knowledge of CI/CD pipelines and working with Azure Devops.
• Experience with SAST, DAST and software composition analysis tools.
• Understanding of authentication, including OAuth2 and OpenID Connect.
• Experience managing and remediating vulnerabilities.
• Strong analytical and communication skills.
• Strong technical aptitude across application and cloud security.
• Ability to work effectively in agile environments.

Responsibilities

• Embed security controls within the software development life cycle.
• Perform secure design reviews for applications and APIs.
• Conduct SAST, DAST and software composition analysis.
• Support remediation of vulnerabilities with development teams.
• Integrate security tooling into CI/CD pipelines.
• Define secure coding standards aligned to OWASP best practice.
• Conduct threat modelling for critical systems.
• Ensure secure cloud configurations.
• Develop detection's for application security events and support incident response for application-related threats.
• Maintain the application risk register and vulnerability tracking.
• Provide guidance and training to developers on secure coding.
• Support security improvement and DevSecOps maturity initiatives.

Skills

Azure

OWASP vulnerabilities

C# / .NET

CI/CD pipelines

SAST, DAST, SCA tools

OAuth2 / OpenID Connect

remediation of vulnerabilities

analytical & communication skills

application & cloud security

agile environments

Job description

Job Description:

Our client is looking to appoint an Application Security Engineer to embed security into the software development life cycle. You will act as a subject-matter expert in application and cloud security, providing assurance, secure design guidance and vulnerability remediation support, and ensuring that secure coding, monitoring and vulnerability management practices are consistently applied. This role is well suited to someone already working in that space or a developer that is looking for a move into being more security focused and looking at how security is embedded with the SDLC.

Skills/Experience:

• Experience securing applications in cloud environments, ideally Azure
• Strong understanding of OWASP vulnerabilities.
• Software development experience ideally with C# / .NET.
• Knowledge of CI/CD pipelines and working with Azure Devops
• Experience with SAST, DAST and software composition analysis tools.
• Understanding of authentication, including OAuth2 and OpenID Connect.
• Experience managing and remediating vulnerabilities.
• Strong analytical and communication skills.
• Strong technical aptitude across application and cloud security.
• Ability to work effectively in agile environments.

Core Responsibilities:

• Embed security controls within the software development life cycle.
• Perform secure design reviews for applications and APIs.
• Conduct SAST, DAST and software composition analysis.
• Support remediation of vulnerabilities with development teams.
• Integrate security tooling into CI/CD pipelines.
• Define secure coding standards aligned to OWASP best practice.
• Conduct threat modelling for critical systems.
• Ensure secure cloud configurations.
• Develop detection's for application security events and support incident response for application-related threats.
• Maintain the application risk register and vulnerability tracking.
• Provide guidance and training to developers on secure coding.
• Support security improvement and DevSecOps maturity initiatives.

Core-Asset Consulting is an equal opportunities recruiter and we welcome applications from everyone irrespective of age, disability, gender, gender identity or expression, race, colour, ethnic or national origin, sexual orientation, religion or belief, marital/civil partner status or pregnancy.

To apply for this vacancy applicants must be eligible to work in the UK in accordance with the Immigration, Asylum and Nationality Act 2006.

At Core-Asset, we're committed to protecting and respecting your privacy. Our privacy statement explains when and why we collect personal information about people who engage with our services, how we use it, the conditions under which we may disclose it to others, and how we keep it secure. We may change this policy from time to time, so please check this policy occasionally to ensure that you're happy with any changes.

By engaging with us (either by applying for a job we're advertising, registering through our website, or getting in touch with our business) you're agreeing to be bound by this policy.

Core-Asset Consulting is committed to protecting the privacy of our candidates, clients and website users. For further information, please refer to our full Privacy Statement available on our website http://www.core-asset.co.uk/about-core-asset/privacy-statement

Core-Asset Consulting offers specialist recruitment services to asset management, accounting & finance, asset servicing, legal and the wider financial services sector in Scotland.