Application Security Manager

easypaisa digital bank; Islamabad; On-site; PKR 2,000,000 - 3,200,000; Full time

Job summary

easypaisa digital bank in Pakistan is seeking an experienced Information Security professional to oversee the secure deployment of servers, applications, containers and databases, guiding the team to address security gaps and support production readiness.

You will assist the Head of Information Security/CISO in managing the Information Security Risk Register for Application Security, review third-party integrations, and prepare MIS reports for stakeholders, highlighting risks and mitigations.

Qualifications

• Bachelor's degree in CS/IS/Engineering from a reputable institute.
• +5 years hands-on experience in server, application vulnerability scanning and penetration testing.
• Certifications relevant to the position preferred.
• 2-3 years hands-on experience in application security, server vulnerability scanning and penetration testing.
• Understanding of MITRE ATT&CK, OWASP, OSTMM; added advantage.

Responsibilities

• Oversee the secure deployment of servers, applications, containers and databases.
• Guide the team in addressing security gaps and manage the Information Security Risk Register.
• Conduct vulnerability assessments and penetration testing for desktop, web, mobile apps, APIs and servers.
• Review BRD/PRD and third‑party integrations for security requirements.
• Provide security education to developers and admins on requirements and resolutions.
• Develop metrics for secure development and data loss prevention.
• Participate in information security risk assessments and audits.
• Prepare reports for stakeholders highlighting risks and mitigations.

Skills

Vulnerability scanning

Penetration testing

Static/Dynamic analysis

Cloud security

Security governance

MITRE ATT&CK

OWASP

SmartSheet

Education

Bachelor’s in CS/IS/Engineering

Tools

SmartSheet

Job description

About easypaisa digital bank:

easypaisa is Pakistan’s first digital bank and has advanced Pakistan’s digital finance landscape. Backed by our shareholders, Telenor Group-a leading telecom operator in Asia and the Nordics- and Ant Group-the force behind Alipay, the world’s leading open internet platform, easypaisa deliver secure, convenient financial solutions to millions of Pakistanis.

POSITION SUMMARY:

Incumbent would be responsible for overseeing the secure deployment of servers, applications, containers and databases, guiding the team in addressing security gaps, and assisting in managing the Information Security Risk Register with a focus on Application Security.

Assisting the Head of Application Security, GRC or CISO in managing the Information Security Risk Register specifically related to Application Security threats and risks. This includes identifying and prioritizing risks, as well as preparing reports and management information system (MIS) on assessments for relevant stakeholders.

DUTIES & RESPONSIBILITIES:

1. Conducting a variety of assessments, including vulnerability assessments and penetration testing, for various types of applications (desktop, web, mobile), APIs, databases, containers, integrations, and servers.
2. Ensuring the security of servers, applications, and databases before they are deployed to the production environment. This includes overseeing vulnerability assessments and penetration testing.
3. Providing guidance to developers and systems administrators on securing the environment and addressing any identified security gaps.
4. Performing vulnerability assessments and penetration testing for cloud-based applications, whether developed in-house or received from third parties, and tracking progress using a smart sheet.
5. Reviewing Business Requirement Documents (BRD) and Product Requirement Documents (PRD), both for in-house change requests and third-party integrations.
6. Participating in Cross Functional Team (CFT) meetings and reviewing the flow of third-party integrations in a phased manner.
7. Conducting static and dynamic analysis, as well as penetration testing, for mobile and web applications to identify any security gaps.
8. Assessing all third-party integrations and APIs according to a defined roadmap and plan.
9. Managing a team to conduct both ad-hoc and planned reviews, ensuring timely closure of security matters.
10. Maintaining a tracker within a smart sheet to keep a record of assessments performed and following up with relevant teams on the status of vulnerability fixes, as well as pushing for prioritization of timelines.
11. Reviewing information security requirements for contract agreements with external business partners.
12. Preparing reports to share with relevant stakeholders, highlighting risks and suggesting mitigation strategies, and following up on the implementation of these strategies.
13. Interacting with developers and system administrators to provide security education, helping them understand information security requirements and addressing findings by offering resolutions.
14. Developing metrics programs for secure development and data loss prevention programs.
15. Participating in the Information Security Awareness Program of the organization.
16. Conducting regular security audits, both from a theoretical and hands‑on standpoint, to assess the effectiveness of security measures.
17. Participating in Information Security Risk Assessments and sharing reports.
18. Undertaking any other responsibilities and additional duties assigned by the Head of Information Security or Chief Information Security Officer (CISO).

QUALIFICATION & EXPERIENCE:

• Minimum bachelor’s in computer science (CS/IS or Engineering) from a reputable institute.
• Should have +5 Years of hands on experience of Server, Application Vulnerability Scanning and Penetration Testing.
• Certifications relevant to Position will be preferred.
• 2-3 years of hands on experience in Application Security, Server, Application Vulnerability Scanning and Penetration Testing.

Understanding of MITRE Attack, OWASP, OSTTM and other security frameworks is an added advantage