Senior Application Security Specialist

Old Mutual Life Assurance Company (SA) Ltd (PFA)

Johannesburg

On-site

ZAR 900,000 - 1,500,000

Full time

2 days ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Job summary

Old Mutual Life Assurance Company (SA) Ltd (PFA) is seeking an Application Security Lead to steer the security of the software the business develops, buys and runs, across the secure development lifecycle, code and dependency scanning, application testing, third-party and SaaS security, application identity and access, and AI features.

You will lead the Application Security team, set standards, oversee tooling and testing, coordinate external penetration testing, and ensure secure release with

Qualifications

National diploma or equivalent in Computer Science, Information Systems, Engineering, or related field.
5+ years in application security or security testing, with at least 3 years in a dedicated role.
2+ years leading a team or security workstream.
Hands-on experience with SAST, SCA, DAST and secrets scanning in CI/CD.
Knowledge of OWASP Top 10, OWASP ASVS, API Security Top 10, and SDLC controls (ISO 27001 or NIST CSF).
Preferred: OSCP, CISSP or equivalent.

Responsibilities

Lead the Application Security team across secure development lifecycle and testing.
Set security standards for developers and approve releases.
Manage SAST/DAST/ SCA tooling and reduce false positives.
Coordinate penetration tests with external providers and retest findings.
Oversee security for third-party and SaaS applications and contractual security requirements.
Oversee identity and access standards (SSO, MFA, OAuth/OIDC, API authentication).
Oversee security reviews for AI integrations, prompt injection and API keys protection.

Skills

Application security

Team leadership

Threat modelling

SAST/DAST/ SCA

CI/CD security

Education

Diploma in Computer Science/Info Systems/Engineering or equivalent

Tools

SAST tooling

SCA tooling

DAST tooling

Secrets scanning tooling

CI/CD tooling

Job description

Let's Write Africa's Story Together! Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

Job Description

Leads the Application Security team in IT GRCS, Information and Cybersecurity, and is accountable for building security into the software the business develops, buys and runs - across the secure development lifecycle, code and dependency scanning, application testing, third-party and SaaS applications, application identity and access, and AI features in our applications.

Responsibilities

The Application Security Lead makes sure software reaches production with known risks found, fixed or formally accepted. The role sets the application security standards developers work to, runs the tooling and testing that verifies them, and signs off security before release.

It is a hands-on lead role. Lead is expected to read scan output, scope tests and challenge findings alongside the two analysts, while owning the service as a whole.

The service areas below are the team's current remit. The Lead owns all seven and delivers them through the two analysts.

Secure development lifecycle

Security requirements in design, threat modelling on new and changed systems

Code and dependency scanning

SAST in CI/CD pipelines, software composition analysis for open-source components, and secrets scanning. Owns tool coverage, rule tuning and false-positive rates.

Application testing

DAST and API security testing, scoping and coordinating penetration tests with external providers, and retesting fixed findings to closure.

Third-party and SaaS applications

Security assessments of applications the business buys, SaaS configuration reviews, and the security requirements written into contracts with Procurement and Legal.

Application identity and access

SSO and MFA integration standards, API authentication standards, and web application firewall rules.

AI in our applications

Security reviews of AI integrations, testing for prompt injection and data leakage, and protection of AI API keys and connections.

The Lead also keeps the application security standard, the finding severity and remediation-SLA model, and the exception and risk-acceptance process current, and reports application risk to the Manager, Information and Cybersecurity.

Leadership and stakeholder responsibilities

Manages Application Security Analysts: workload allocation, performance reviews, development plans and technical coaching.

Builds the bench: cross-skills the analysts so no single service area depends on one person.

Partners with development and delivery leads so security work is planned into sprints rather than raised at release.

Manages external penetration testing providers: scoping, scheduling, quality of findings and spend against budget.

Escalates risks that cannot be remediated in SLA to the Manager, Information and Cybersecurity with a clear recommendation.

Qualifications and experience

Minimum requirements

National diploma in Computer Science, Information Systems, Engineering or equivalent. Demonstrable experience may substitute for the qualification.

5+ years in application security or security testing, of which at least 3 years in a dedicated application security role.

2+ years leading a team, a squad or a security workstream, formally or as a technical lead.

Hands-on experience with SAST, SCA, DAST and secrets scanning tooling, and with embedding them in CI/CD pipelines.

Working knowledge of OWASP Top 10, OWASP ASVS and API Security Top 10, and of the SDLC controls expected under a recognised framework such as ISO 27001 or NIST CSF.

Preferred