Position Title:IT Application Security Specialist Department:Information Technology Security
Job Purpose:The Application Security Specialist is responsible for designing, implementing, and governing application security across enterprise systems, ensuring that all applications are secure by design and compliant with organizational and regulatory requirements.
The role focuses on integrating security into the Software Development Lifecycle (SDLC), driving Dev Sec Ops practices, and establishing secure architecture standards across cloud, on-premises, and hybrid environments.
Key Responsibilities:1. Application Security Strategy Develop and maintain the enterprise Application Security program Define and implement secure-by-design principles across all applications Establish and monitor key security metrics (e.g., vulnerability reduction, remediation timelines) Continuously improve application security maturity
2. Security Architecture & Design (Knowledge) Design and review secure architectures for applications, APIs, and microservices Lead threat modeling activities (e.g., STRIDE methodology) Define and enforce security design patterns, including authentication, encryption, and data protection Participate in architecture governance and review forums
3. Dev Sec Ops & Secure SDLCIntegrate security controls into CI/CD pipelines Implement and manage application security testing tools (SAST, DAST, SCA) Establish secure coding standards aligned with OWASP Top 10Automate security validation and enforcement across development pipelines
4. Cloud Security Design and implement secure cloud architectures across AWS and/or Azure environments Enforce Identity and Access Management (IAM) and Zero Trust principles Secure containerized environments (Kubernetes / Open Shift) Ensure effective monitoring, logging, and threat detection in cloud platforms
5. Security Testing & Assurance Coordinate vulnerability assessments, penetration testing, and application security reviews Ensure timely remediation and closure of identified vulnerabilities Validate security controls through regular testing and simulation exercises
6. Security Operations Integration Collaborate with SOC teams to enhance monitoring and incident response capabilities Support SIEM use case development and optimization Analyze security trends and proactively identify emerging risks
7. Governance, Risk & Compliance Ensure adherence to security standards and regulatory requirements, including:PCI DSSSWIFT CSPISO 27001Support internal and external audits and regulatory assessments Develop and maintain security policies, standards, and procedures
8. Stakeholder Engagement & Awareness Provide security guidance to development, Dev Ops, and architecture teams Conduct training and awareness sessions on secure coding practices Act as a trusted advisor on application security matters
Qualifications & Experience:Bachelor’s degree in computer science, Cybersecurity, Software Engineering, or a related field Minimum 8–12 years of experience in cybersecurity, with strong focus on:Application Security Dev Sec Ops Cloud Security Experience in the banking or financial services sector preferred
Required Skills & Competencies:Technical Skills:Strong knowledge of:OWASP Top 10 and secure coding practices Secure SDLC and threat modeling techniques API and web application security Experience with application security tools:SAST, DAST, and SCA platforms Proficiency in cloud security (AWS / Azure) Knowledge of container security (Kubernetes / Open Shift) Familiarity with SIEM, vulnerability management, and security monitoring
Behavioral Competencies:Strong analytical and problem-solving skills Effective communication and stakeholder management Ability to influence cross-functional teams Strong attention to detail and risk awareness
Professional Certifications:Required (Minimum 2):CISSP (Certified Information Systems Security Professional) CCSP (Certified Cloud Security Professional) CISM or CRISC
Preferred:CEH (Certified Ethical Hacker) Microsoft Azure Security Engineer (AZ-500) or AWS Security Specialty OSCP (Offensive Security Certified Professional)
Additional Information:This role requires close collaboration with development, infrastructure, and security teams The position involves both strategic planning and hands-on technical contributions Experience in regulated environments is highly desirable