DevSecOps and Attack Surface Specialist

Intact Insurance (previously RSA); Horsham; Hybrid; GBP 75.000 - 110.000; Vollzeit

Benefits dieser Stelle

Annual discretionary incentive plan

Hybrid working (60% office-based)

25 days annual leave + holidays andbuy

Flexible benefit options

Share investment options

Career development and mentoring

Inclusive culture and employee network

Zusammenfassung

Intact Insurance is seeking an Applications Security Specialist to drive a shift-left security program across the software development lifecycle in the UK. You will manage pentests and SAST/DAST/ SCA tooling, build secure coding practices, and oversee external domain exposure while expanding AI security capabilities.

The role emphasizes proactive vulnerability validation, asset discovery, and integration with CI/CD pipelines to ensure robust protection for commercial and specialty insurances

Qualifikationen

• Strong understanding of application security principles across the full software development lifecycle.
• Hands on experience with SAST and SCA tooling such as Semgrep, Checkmarx, Snyk, and OWASP Dependency Check.
• Experience configuring and operating DAST tools such as OWASP ZAP, Burp Suite Enterprise, and Invicti.
• Ability to triage, validate, and reproduce vulnerabilities through manual testing and proof of concept development.
• Working knowledge of secure coding practices across common languages and frameworks.
• Familiarity with CI and CD pipeline integration, including implementation of security gates and automated controls.
• Experience with attack surface management, including asset discovery, domain enumeration, and external exposure analysis.

Aufgaben

• Champion a shift left philosophy, driving automated security controls earlier in development while validating vulnerabilities identified through testing.
• The specialist will lead application security initiatives, managing Pentest, SAST, SCA and DAST scanning and remediation activities and maintaining asset inventories.
• Manage Intact's external application attack surface by monitoring and assessing new and existing domains.
• Lead integration of AI-specific security practices across the organisation and support expansion of AI capabilities within the cyber defence team.

Kenntnisse

Application security lifecycle

Vulnerability triage & PoC

Secure coding practices

CI/CD security gates

Attack surface management

Tools

Semgrep

Checkmarx

Snyk

OWASP Dependency Check

OWASP ZAP

Burp Suite Enterprise

Invicti

Jobbeschreibung

You’ll make an impact by:

Intact Insurance is a leading provider of Commercial and Specialty insurance solutions for businesses of all sizes across the UK and Ireland and through its Global Network in over 150 countries worldwide. Intact Insurance is part ofIntact Financial Corporation, the largest provider of Property and Casualty insurance in Canada and a leading Specialty lines insurer with international expertise. We aim to deliver second-to-none service and help brokers and businesses thrive in a fast-moving world.

• The specialist will champion a shift left philosophy, driving automated security controls earlier in the development process while maintaining rigorous validation of vulnerabilities identified through dynamic and static testing.
• You will lead application security initiatives, managing Pentest, SAST, SCA and DAST scanning and remediation activities and maintaining asset inventories.
• The specialist will be responsible for managing Intact's external application attack surface by monitoring and assessing new and existing domains.
• You will also lead the integration of AI specific security practices across the organisation and also support the expansion of AI capabilities within the cyber defence team

Your skills and experience:

• Strong understanding of application security principles across the full software development lifecycle
• Hands on experience with SAST and SCA tooling such as Semgrep, Checkmarx, Snyk, and OWASP Dependency Check
• Experience configuring and operating DAST tools such as OWASP ZAP, Burp Suite Enterprise, and Invicti
• Ability to triage, validate, and reproduce vulnerabilities through manual testing and proof of concept development
• Working knowledge of secure coding practices across common languages and frameworks
• Familiarity with CI and CD pipeline integration, including implementation of security gates and automated controls
• Experience with attack surface management, including asset discovery, domain enumeration, and external exposure analysis

Shape the future

We're leading a transformation in insurance helping people, businesses and society prosper in good times and be resilient in bad times. When you join us, you're not just taking a job – you're stepping into a career where you can make a real difference.

Grow with us

We're customer-driven, community-focused, and committed to helping our people grow. Whether you're early in your journey or bringing years of experience, we'll support you with the tools, flexibility, and opportunities to thrive while going the extra mile for customers, brokers and colleagues.

Why you'll love it here

Being part of our team means you'll have the support and freedom to bring your best self to work each day. Here's a flavour of what you can look forward to:

• Annual discretionary incentive plan
• Hybrid working (with 60% of your time office-based)
• 25 days annual leave plus bank holidays and buy/sell options
• Flexible benefit options including financial and health wellbeing
• Share investment options
• Career development and mentoring
• Inclusive culture and employee networks

Our DEI commitment

We celebrate individuality and believe our differences make us stronger. We're proud to foster a culture where everyone feels respected, valued, and empowered to thrive.

As an equal opportunity employer, we ensure fair consideration for all applicants and offer interviews to all disabled candidates who meet the essential criteria.

We understand that everyone's circumstances are different and are happy to explore flexible working options—such as reduced hours or job shares to support work–life balance.