Lead Application Security Engineer

Old Mutual Insure Limited; Johannesburg; Presencial; ZAR 1 000 000 - 1 800 000; Tempo integral

Resumo da oferta

Old Mutual Insure Limited seeks an experienced Application Security Lead to head the IT GRCS security team. You will embed security across the SDLC, run SAST/DAST/SCA tooling, manage third-party security assessments and drive secure coding practices.

You will lead two analysts, coordinate with development teams, and ensure security sign-off before production releases. Prior experience in financial services security and cloud (Azure/AWS) is essential.

Qualificações

• Minimum National diploma in Computer Science, Information Systems, Engineering or equivalent.
• 5+ years in application security or security testing, of which at least 3 years in a dedicated application security role.
• 2+ years leading a team, a squad or a security workstream, formally or as a technical lead.
• Hands-on experience with SAST, SCA, DAST and secrets scanning tooling, and embedding them in CI/CD pipelines.
• Working knowledge of OWASP Top 10, OWASP ASVS and API Security Top 10, and of SDLC controls under ISO 27001 or NIST CSF.
• Preferred OSCP, CISSP or equivalent.
• Financial services or insurance experience, including familiarity with POPIA and regulatory expectations on an insurer's software estate.
• Cloud application security experience on Azure or AWS, including container and pipeline security.
• Competencies Technical Designs and tunes security tooling in pipelines so it catches real issues without stalling delivery.
• Scopes and interprets penetration tests and can tell a genuine exploit path from a scanner artefact.
• Models threats against modern architectures: APIs, microservices, SaaS integrations and AI services.
• Assesses identity and access design: OAuth 2.0, OIDC, SAML, token handling and WAF policy.
• Matric and relevant Information Technology Qualification – diploma or degree 3-5 years Information or cyber security related experience Security Awareness and Culture Professional (SACP) Excellent interpersonal, communication and presentation skills Established experience in phishing simulations and training programs Administration of a learning / phishing platform

Responsabilidades

• Lead the Application Security team and ensure secure development lifecycle compliance.
• Set security standards, run tooling and testing, and sign off before release.
• Hands-on leadership of security workstream across seven service areas.
• Read scan outputs, scope tests and challenge findings with analysts, owning the service.
• Coordinate external penetration testing providers and ensure remediation within SLA.
• Report application risk to the Manager, Information and Cybersecurity.
• Partner with development and delivery leads to plan security into sprints.
• Maintain documentation for the app security standard, remediation SLA model and risk-acceptance processes.

Conhecimentos

SAST

SCA

DAST

Secrets scanning

CI/CD pipelines

Threat modelling

OWASP Top 10

API Security

Security leadership

Stakeholder management

Formação académica

Bachelor of Commerce (BCom): Information Technology And Computer Science: Information Technology Management

National diploma in Computer Science / Information Systems / Engineering or equivalent

Ferramentas

SAST tooling

SCA tooling

DAST tooling

Secrets scanning tooling

CI/CD tooling integration

Descrição da oferta de emprego

Old Mutual Insure Limited seeks an experienced Application Security Lead to head the IT GRCS security team. You will embed security across the SDLC, run SAST/DAST/SCA tooling, manage third-party security assessments and drive secure coding practices.

You will lead two analysts, coordinate with development teams, and ensure security sign-off before production releases. Prior experience in financial services security and cloud (Azure/AWS) is essential.