Secure Coding Domain Expert – Application Security

Stafide; Amsterdam; Sur place; EUR 70 000 - 100 000; Plein temps

Résumé du poste

Stafide seeks a Secure Coding Domain Expert to strengthen application security posture across development teams. You will define secure coding standards, analyse findings from SAST/SCA tooling, and guide developers in implementing fixes within CI/CD pipelines.

Ideal candidates have 4-6 years in secure coding or software security, experience with Fortify/Nexus Lifecycle, and strong English communication in a large enterprise setting.

Qualifications

• 4-6 years of professional experience in secure coding or application security.
• Hands-on experience with SAST and SCA tools (Fortify, Nexus Lifecycle or similar).
• Experience analysing security findings by severity and remediation needs.
• Understanding of secure software development practices in DevOps/CI-CD environments.

Responsabilités

• Promote secure software development across development teams.
• Define and improve secure coding standards and guidelines across technologies.
• Analyse, triage, and prioritise security findings from SAST/SCA tools.
• Assist developers in understanding findings and implementing fixes in code.

Connaissances

Secure coding

Application security

SAST/SCA tooling

CI/CD security

Communication in English

Outils

Fortify

Nexus Lifecycle

Description du poste

Secure Coding Domain Expert – Application Security (ID: 4089)

As a Secure Coding Domain Expert, you will:

• Maintain and improve the organisation’s application security posture by promoting secure software development practices across development teams.
• Define, maintain, and continuously improve secure coding standards, guidelines, and best practices across different technologies.
• Analyse, triage, and prioritise security findings generated by Static Application Security Testing (SAST) and Software Composition Analysis (SCA) tools.
• Work with security tools such as Fortify, Nexus Lifecycle, or similar platforms to identify vulnerabilities, assess risks, and recommend appropriate remediation.
• Support developers in understanding security findings, investigating root causes, and implementing effective fixes in application code.
• Improve security tooling by fine-tuning detection rules, reducing false positives, enhancing finding quality, and increasing the effectiveness of security scans.
• Contribute to internally developed security tools, including repository scanning solutions, and help improve automation within the secure development lifecycle.
• Research emerging application security risks, including AI-driven attacks and agentic development, while sharing knowledge and helping development teams adopt more secure practices.

What You Bring to the Table:

• 4-6 years of overall professional experience, with relevant experience in secure coding, application security, or software development security.
• Practical experience in secure coding principles, application vulnerability assessment, and identifying security weaknesses in software.
• Proficiency in at least one programming language, with the ability to understand application code and support vulnerability remediation.
• Hands-on experience with SAST and SCA tools such as Fortify, Nexus Lifecycle, or equivalent security analysis platforms.
• Experience analysing, triaging, prioritising, and explaining security findings based on their severity, impact, and remediation requirements.
• Understanding of secure software development practices and integration of security checks into DevOps and CI/CD pipelines.
• Familiarity with Agile ways of working and continuous integration and continuous delivery (CI/CD) practices; Microsoft Azure is a listed competency.
• Strong communication skills, fluent English, a pragmatic approach to problem solving, and the ability to work effectively within a large corporate organisation.

You Should Possess the Ability to:

• Interpret SAST and SCA findings, distinguish actionable vulnerabilities from false positives, and recommend appropriate remediation.
• Explain technical security issues clearly to developers and guide them towards practical, effective fixes.
• Review application code and assess security risks across different technologies and development environments.
• Maintain and improve secure coding standards, ensuring that guidelines remain relevant and practical for development teams.
• Fine-tune security scanning rules and tooling configurations to improve detection accuracy and reduce unnecessary findings.
• Collaborate with developers, security specialists, and other stakeholders to integrate security into everyday development activities.
• Investigate emerging security threats, including risks associated with AI-driven attacks and agentic software development.
• Share security knowledge, influence secure development practices, and balance security requirements with practical delivery needs.

What We Bring to the Table:

• The opportunity to contribute to application security and secure coding initiatives within a large enterprise banking environment.
• Exposure to security analysis tools, including Fortify, Nexus Lifecycle, and similar SAST/SCA platforms.
• Opportunities to work closely with software development teams across different technologies and applications.
• Involvement in improving security tooling, scanning rules, repository analysis, and vulnerability remediation processes.
• Opportunities to contribute to secure coding standards and strengthen security throughout the software development lifecycle.
• Exposure to evolving application security challenges, including AI-driven threats and agentic development.
• A collaborative environment that encourages knowledge sharing, continuous improvement, and pragmatic security solutions.
• The opportunity to influence secure software development practices and help teams deliver more secure applications.