Application security engineer in cybersecurity

act digital; Lisboa; Hybrid; EUR 90,000 - 130,000; Full time

Job summary

act digital ищет старшего специалиста по Application Security в Лиссабоне. Вы формируете стратегию безопасности приложений, руководите инициативами DevSecOps и обучаете младших инженеров.

Ведёте внедрение SAST, SCA, DAST, сканирование контейнеров, IaC и секретов; интегрируете защиту в CI/CD; развиваете сообщество специалистов и проводите обучающие сессии.

Требуется высокий уровень английского и подтвержденный опыт лидирования проектов AppSec.

Qualifications

• 6–9 лет опыта в кибербезопасности и AppSec.

Responsibilities

• Определять и развивать стратегию Application Security и дорожную карту.

Skills

Leadership in AppSec

English fluency

SAST/SCA/DAST

IaC scanning

CI/CD security

Programming (Python/C#/C++)

Cloud security

OWASP Top 10

DevSecOps

Education

Master's degree

Tools

SAST tools

SCA tools

DAST tools

Container scanning

IaC scanning tools

Job description

Описание:

Описания нет

Задачи:

Contribute to the definition and evolution of the Application Security strategy and roadmap. Lead and coordinate Application Security initiatives across the development ecosystem. Mentor and guide junior Application Security Engineers. Drive the continuous improvement and adoption of the IT Secure Software Development Lifecycle (IT S-SDLC) Framework. Ensure alignment with organizational security policies, standards and IT Risk Management requirements. Provide expert-level technical support and advisory services to development squads. Lead complex vulnerability assessments, investigations and remediation activities. Support development teams in identifying, prioritizing and addressing security vulnerabilities. Oversee the implementation and optimization of SAST, SCA, DAST, container scanning, IaC scanning and secrets detection solutions. Ensure the effective integration of security controls into CI/CD pipelines. Define and promote application security best practices and secure coding standards. Lead and animate the Application Security community through advanced workshops, knowledge-sharing sessions and training initiatives. Conduct weekly open sessions to support developers and technical leads with security-related challenges. Develop and maintain comprehensive technical documentation, guidelines and best practices. Promote security awareness and strengthen the adoption of secure development practices across engineering teams. Monitor, analyze and optimize Application Security KPIs, KRIs and OKRs. Conduct technological watch and analyze emerging cybersecurity threats, vulnerabilities and industry trends. Identify opportunities to improve existing security processes, tools and methodologies. Propose, evaluate and lead Proofs of Concept (PoCs) for innovative Application Security solutions. Drive continuous optimization of vulnerability detection, remediation workflows and security tooling. Contribute to First Line of Defense (LoD1) IT Risk Management (ITRM) activities. Monitor application security and IT risk topics, ensuring compliance with organizational policies and operational standards. Support the implementation and effective adoption of security controls across development teams. Identify potential IT risks and recommend appropriate mitigation measures.

Требования:

• 6 to 9 years of professional experience in Cybersecurity, Application Security (AppSec) and/or DevSecOps.
• Master's degree (Bac+5) or equivalent higher education qualification.
• Fluent English is mandatory.
• Proven experience leading Application Security projects and driving security initiatives across development teams.
• Advanced proficiency in SAST, SCA, Container Image Scanning and DAST tools.
• Strong knowledge of Infrastructure as Code (IaC) scanning and Secrets Detection tools.
• Proven experience integrating security and quality assurance tools into CI/CD pipelines.
• Expert-level knowledge of at least one programming language, such as Python, C++, C# or equivalent.
• Familiarity with development frameworks and technologies such as Hadoop and Angular.
• Deep understanding of OWASP Top 10 vulnerabilities.
• Advanced expertise in vulnerability assessment, analysis, prioritization and remediation strategies.
• Ability to identify and reduce false positives and optimize security scanning processes.
• Knowledge of End-of-Support (EOS) lifecycle management and associated security risks.
• Comprehensive knowledge of cloud security principles across private, public, regulated and hybrid environments.
• Будет плюсом: French is considered an asset

Условия:

2x week at the office