Application Security Risk Manager

Kerry Consulting; Singapore; On-site; SGD 120,000 - 190,000; Full time

Job summary

Kerry Consulting is seeking an experienced Application Security Risk Manager to provide risk oversight across application security and technology controls. You will partner with Technology, Cybersecurity and Engineering teams to identify risks and ensure secure design, development, and operation of applications.

Responsibilities include risk assessments for new apps, reviewing security controls across the SDLC, evaluating vulnerabilities and access management, and overseeing incidents and

Qualifications

• 8-15 years of experience across application security, cybersecurity, technology risk, security architecture or technology assurance.
• Strong understanding of application security, SDLC and secure software development.
• Familiarity with SAST, DAST, penetration testing and frameworks such as OWASP, NIST and ISO 27001.
• Knowledge of DevSecOps, CI/CD, APIs, IAM, vulnerability management and cloud security.
• Financial services and regulatory experience would be advantageous.

Responsibilities

• Provide risk oversight and challenge across application security and software development activities.
• Conduct security risk assessments for new applications, major technology changes and critical systems.
• Assess security controls across the SDLC, including secure design, development, testing, deployment and production.
• Review risks relating to application vulnerabilities, APIs, integrations, authentication, access management and data protection.
• Assess DevSecOps and CI/CD controls, including SAST, DAST, penetration testing and vulnerability management.
• Review security exceptions, risk assessments and remediation plans and provide independent challenge where required.
• Assess application security across on-premise, cloud and hybrid environments.
• Conduct thematic reviews to identify systemic risks and control weaknesses.
• Oversee significant application security incidents and remediation.
• Develop risk metrics and contribute to application security policies, standards and control frameworks.
• Monitor emerging application security threats and advise stakeholders on relevant risks.

Skills

Application security

Cybersecurity

Technology risk

Security architecture

SDLC security

DevSecOps

CI/CD

APIs

IAM

Vulnerability management

Communication

Stakeholder management

Analytical skills

Security certifications awareness

Tools

SAST tools

DAST tools

Penetration testing

OWASP

NIST

ISO 27001

Job description

We are seeking an experienced Application Security Risk Manager to provide risk oversight and challenge across application security and technology controls.

The role will partner with Technology, Cybersecurity and Engineering teams to identify security risks and ensure applications are designed, developed and operated securely.

Key Responsibilities:

• Provide risk oversight and challenge across application security and software development activities.
• Conduct security risk assessments for new applications, major technology changes and critical systems.
• Assess security controls across the SDLC, including secure design, development, testing, deployment and production.
• Review risks relating to application vulnerabilities, APIs, integrations, authentication, access management and data protection.
• Assess DevSecOps and CI/CD controls, including SAST, DAST, penetration testing and vulnerability management.
• Review security exceptions, risk assessments and remediation plans and provide independent challenge where required.
• Assess application security across on-premise, cloud and hybrid environments.
• Conduct thematic reviews to identify systemic risks and control weaknesses.
• Oversee significant application security incidents and remediation.
• Develop risk metrics and contribute to application security policies, standards and control frameworks.
• Monitor emerging application security threats and advise stakeholders on relevant risks.

Requirements:

• 8-15 years of experience across application security, cybersecurity, technology risk, security architecture or technology assurance.
• Strong understanding of application security, SDLC and secure software development.
• Knowledge of DevSecOps, CI/CD, APIs, IAM, vulnerability management and cloud security.
• Experience assessing application security controls and technology risks.
• Familiarity with SAST, DAST, penetration testing and frameworks such as OWASP, NIST and ISO 27001.
• Financial services and regulatory experience would be advantageous.
• Strong analytical, communication and stakeholder management skills.
• Certifications such as CISSP, CISM, CRISC, CSSLP or CCSP would be advantageous