Senior Application Security Specialist

Old Mutual Insure Limited; Johannesburg; On-site; ZAR 1,000,000 - 1,800,000; Full time

Job summary

Old Mutual Insure Limited seeks an experienced Application Security Lead to head the IT GRCS security team. You will embed security across the SDLC, run SAST/DAST/SCA tooling, manage third-party security assessments and drive secure coding practices.

You will lead two analysts, coordinate with development teams, and ensure security sign-off before production releases. Prior experience in financial services security and cloud (Azure/AWS) is essential.

Qualifications

• Minimum National diploma in Computer Science, Information Systems, Engineering or equivalent.
• 5+ years in application security or security testing, of which at least 3 years in a dedicated application security role.
• 2+ years leading a team, a squad or a security workstream, formally or as a technical lead.
• Hands-on experience with SAST, SCA, DAST and secrets scanning tooling, and embedding them in CI/CD pipelines.
• Working knowledge of OWASP Top 10, OWASP ASVS and API Security Top 10, and of SDLC controls under ISO 27001 or NIST CSF.
• Preferred OSCP, CISSP or equivalent.
• Financial services or insurance experience, including familiarity with POPIA and regulatory expectations on an insurer's software estate.
• Cloud application security experience on Azure or AWS, including container and pipeline security.
• Competencies Technical Designs and tunes security tooling in pipelines so it catches real issues without stalling delivery.
• Scopes and interprets penetration tests and can tell a genuine exploit path from a scanner artefact.
• Models threats against modern architectures: APIs, microservices, SaaS integrations and AI services.
• Assesses identity and access design: OAuth 2.0, OIDC, SAML, token handling and WAF policy.
• Matric and relevant Information Technology Qualification – diploma or degree 3-5 years Information or cyber security related experience Security Awareness and Culture Professional (SACP) Excellent interpersonal, communication and presentation skills Established experience in phishing simulations and training programs Administration of a learning / phishing platform

Responsibilities

• Lead the Application Security team and ensure secure development lifecycle compliance.
• Set security standards, run tooling and testing, and sign off before release.
• Hands-on leadership of security workstream across seven service areas.
• Read scan outputs, scope tests and challenge findings with analysts, owning the service.
• Coordinate external penetration testing providers and ensure remediation within SLA.
• Report application risk to the Manager, Information and Cybersecurity.
• Partner with development and delivery leads to plan security into sprints.
• Maintain documentation for the app security standard, remediation SLA model and risk-acceptance processes.

Skills

SAST

SCA

DAST

Secrets scanning

CI/CD pipelines

Threat modelling

OWASP Top 10

API Security

Security leadership

Stakeholder management

Education

Bachelor of Commerce (BCom): Information Technology And Computer Science: Information Technology Management

National diploma in Computer Science / Information Systems / Engineering or equivalent

Tools

SAST tooling

SCA tooling

DAST tooling

Secrets scanning tooling

CI/CD tooling integration

Job description

Let's Write Africa's Story Together!

Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

Job Description

Leads the Application Security team in IT GRCS, Information and Cybersecurity, and is accountable for building security into the software the business develops, buys and runs — across the secure development lifecycle, code and dependency scanning, application testing, third-party and SaaS applications, application identity and access, and AI features in our applications.

Responsibilities

The Application Security Lead makes sure software reaches production with known risks found, fixed or formally accepted.

The role sets the application security standards developers work to, runs the tooling and testing that verifies them, and signs off security before release.

It is a hands-on lead role.

Lead is expected to read scan output, scope tests and challenge findings alongside the two analysts, while owning the service as a whole.

The service areas below are the team's current remit.

The Lead owns all seven and delivers them through the two analysts.

• Secure development lifecycle: - Security requirements in design, threat modelling on new and changed systems
• Code and dependency scanning: - SAST in CI/CD pipelines, software composition analysis for open-source components, and secrets scanning. Owns tool coverage, rule tuning and false-positive rates.
• Application testing: - DAST and API security testing, scoping and coordinating penetration tests with external providers, and retesting fixed findings to closure.
• Third-party and SaaS applications: - Security assessments of applications the business buys, SaaS configuration reviews, and the security requirements written into contracts with Procurement and Legal.
• Application identity and access: - SSO and MFA integration standards, API authentication standards, and web application firewall rules.
• AI in our applications: -Security reviews of AI integrations, testing for prompt injection and data leakage, and protection of AI API keys and connections.

The Lead also keeps the application security standard, the finding severity and remediation‑SLA model, and the exception and risk‑acceptance process current, and reports application risk to the Manager, Information and Cybersecurity.

Leadership and stakeholder responsibilities

• Manages Application Security Analysts: workload allocation, performance reviews, development plans and technical coaching.
• Builds the bench: cross-skills the analysts so no single service area depends on one person.
• Partners with development and delivery leads so security work is planned into sprints rather than raised at release.
• Manages external penetration testing providers: scoping, scheduling, quality of findings and spend against budget.
• Escalates risks that cannot be remediated in SLA to the Manager, Information and Cybersecurity with a clear recommendation.

Qualifications and experience

Minimum requirements National diploma in Computer Science, Information Systems, Engineering or equivalent. Demonstrable experience may substitute for the qualification.

5+ years in application security or security testing, of which at least 3 years in a dedicated application security role.

2+ years leading a team, a squad or a security workstream, formally or as a technical lead.

Hands‑on experience with SAST, SCA, DAST and secrets scanning tooling, and with embedding them in CI/CD pipelines.

Working knowledge of OWASP Top 10, OWASP ASVS and API Security Top 10, and of the SDLC controls expected under a recognised framework such as ISO 27001 or NIST CSF.

Preferred One or more of OSCP, CISSP or equivalent.

Financial services or insurance experience, including familiarity with POPIA and the regulatory expectations on an insurer's software estate.

Cloud application security experience on Azure or AWS, including container and pipeline security.

Competencies Technical Designs and tunes security tooling in pipelines so it catches real issues without stalling delivery.

Scopes and interprets penetration tests and can tell a genuine exploit path from a scanner artefact.

Models threats against modern architectures: APIs, microservices, SaaS integrations and AI services.

Assesses identity and access design: OAuth 2.0, OIDC, SAML, token handling and WAF policy.

Matric and relevant Information Technology Qualification – diploma or degree 3-5 years Information or cyber security related experience Security Awareness and Culture Professional (SACP) Excellent interpersonal, communication and presentation skills Established experience in phishing simulations and training programs Administration of a learning / phishing platform

Additional Qualifications /Experience (Preferred, Not a Requirement)

• Other industry certifications are advantageous (i.e., ISO 27001/27002, CISM, etc.)

Skills Competencies

• Communicates
• Effectively
• Courage
• Cultivates
• Innovation
• Decision
• Quality
• Ensures
• Accountability
• Manages
• Complexity
• Nimble
• Learning
• Persuades

Education

Bachelor of Commerce (BCom): Information Technology And Computer Science: Information Technology Management (Required)

Closing Date

11 November 2026 , 23:59

The appointment will be made from the designated group in line with the Employment Equity Plan of Old Mutual South Africa and the specific business unit in question.

The Old Mutual Story!

Old Mutual is a premium African financial services organisation that offers a broad spectrum of financial solutions to retail and corporate customers across key market segments in 14 countries. The lines of business include Life and Savings, Property and Casualty, Asset Management and Banking and Lending. We are rooted in our purpose of Championing Mutually Positive Futures Every Day and believe that a great customer experience is anchored in a great employee experience.