Application Security Lead

Salmon Group Ltd; Town of Poland (NY); On-site; USD 120,000 - 160,000; Full time

Job summary

Salmon Group Ltd is looking for an Application Security expert to enhance their mobile banking platform security. The role involves hands-on tasks such as threat modeling, security reviews, and CI/CD tooling, while reporting to the Group CISO.

The ideal candidate will have 7+ years of experience in application security and a track record of building secure SDLCs in a fast-paced environment. Experience with mobile security testing and risk management is essential.

Qualifications

• 7+ years in application security with process ownership.
• Hands-on mobile security testing experience.
• Ability to influence design decisions through threat modeling.

Responsibilities

• Identify high-risk systems and manage security decisions.
• Run threat modeling for product changes before design locks.
• Own vulnerability management and remediation tracking.

Skills

Application Security

Risk Management

Secure SDLC

Python

Bash

Mobile Security Testing

API Security

Tools

SAST

DAST

SCA

AWS

Job description

The Role

You’ll own application security across our mobile banking platform, payments stack, and a growing set of regulated products. The work is hands‑on: you’ll conduct threat modeling, security reviews, and CI/CD tooling with real process ownership. You’ll report to the Group CISO and work closely with our engineering teams and the Bank IS function.

Justification

As Salmon expands its product lineup like cards, payments, ATM network – the need for a dedicated Application Security function has become critical. Currently there is no specialist owning secure development practices, mobile security testing, or supply chain risk.

This role fills the gap: ensuring internal systems and customer data are protected, embedding security into the product delivery process, and building the AppSec practices needed to meet regulatory expectations and support secure growth.

Responsibilities

Risk‑driven security ownership

• Identify which systems, data flows, and product changes carry the highest real‑world risk and build your work around that, not around tool coverage or compliance checklists.
• Decide when a security gate is worth slowing down a release and when it isn’t, own that call, and be able to explain it to engineering and the CISO.
• Maintain a risk register for application‑layer exposures: what’s open, what’s accepted, what’s being fixed, and why in that order.

Secure SDLC

• Figure out where in our delivery process security decisions are actually being made and put controls there.
• Run threat modeling for high‑stakes product changes before design is locked, not after.
• Build a mobile security testing baseline that the team runs themselves.

CI/CD and supply chain

• Assess what the current pipeline actually catches versus what it produces as noise, and fix the ratio before adding more scanners.
• Own supply chain posture: dependency pinning, SBOM, internal registry, and the response process when a package gets compromised.
• Own secrets detection and remediation end‑to‑end.

Regulatory and cross‑team work

• Translate application security gaps into language that satisfies BSP examiners without over‑engineering the evidence.
• Coordinate security input into new product launches across our Group and Bank structure.

Requirements

Experience

• 7+ years in application security, with meaningful ownership over both technical work and process.
• Has built or substantially improved a secure SDLC in a fast‑moving product org.
• Has run threat modeling on real product features and influenced design decisions as a result.
• Has owned vulnerability management end‑to‑end: triage, remediation tracking, SLA management, risk acceptance.
• Has done hands‑on mobile security testing (iOS and/or Android) in a production context, not just UAT.
• Understands modern supply chain attack vectors like compromised packages (npm, PyPI), malicious IDE plugins, typosquatting, dependency confusion – and knows how to reduce exposure at the tooling and process level.
• Comfortable writing Python or Bash to automate repetitive security work.

Technical Skills

• SAST, DAST, SCA in CI/CD pipelines: knows how to tune for signal, not just coverage.
• API security: authentication flows, token handling, common abuse patterns.
• Mobile security: OWASP ASVS/MASVS applied in practice.
• Supply chain: SBOM generation and dependency risk management.
• Secrets management: detection, remediation, and structural prevention.
• Working knowledge of AWS and containers sufficient to understand where application risks extend into infrastructure.

Nice to have

• Experience in a regulated environment (financial services or similar).
• Familiarity with PCI‑DSS, ISO 27001, or BSP MORB.
• Certifications: OSCP, GWEB, GWAPT, CSSLP.

Communication

• Strong written English; most day‑to‑day alignment is async.
• Can explain a security issue clearly to an engineer and summarize the same issue for a non‑technical stakeholder.