APPLICATION SECURITY

Job description

Mission description:

Excited to make security part of how software gets built in a large telecom environment?

Our client, a major telecom operator, is strengthening its Application Security posture and wants to move from a detect-and-report model towards one that prevents, detects, remediates and continuously improves.

As part of this initiative, you will accelerate the remediation of application vulnerabilities and embed effective security controls directly into the software development lifecycle. You will work side-by-side with the Vulnerability Manager, development teams, software factories, application owners, architects and security teams.

This is a hands-on, delivery-oriented mission – not a purely governance or assessment role.

Service description:

The mission combines two complementary streams:

o   Vulnerability remediation – reducing Critical/High exposure, clearing backlogs and eliminating the root causes of recurring weaknesses together with developers and suppliers.

o   DevSecOps industrialization – integrating, tuning and optimizing AppSec tooling and security gates in CI/CD pipelines so that issues are detected earlier, before production.

The target profile brings together security expertise, a solid understanding of development, DevSecOps engineering skills and a pragmatic remediation capability.

Responsibility – What you will be doing

o   You analyse complex and high-risk findings and challenge false positives.

o   You clarify exploitability, business impact and remediation requirements.

o   You provide practical fix guidance to developers and suppliers.

o   You work directly with developers to resolve vulnerabilities and eliminate recurring root causes through secure coding practices.

o   You integrate and optimize SAST, SCA, DAST, secrets detection, container and IaC security controls in CI/CD pipelines.

o   You support threat modelling, API security, secure design and architecture reviews for critical applications.

o   You support the Vulnerability Manager with technical prioritization, risk analysis, exceptions and actionable KPIs.

o   You review fixes, compensating controls and closure evidence.

o   You support exception and risk-acceptance decisions for blocked items.

Expected deliverables

o   Remediation plans for Critical/High findings.

o   Hands-on remediation workshops with development teams and root-cause analysis of recurrent vulnerabilities.

o   Assessment and optimization of the AppSec toolchain, including improved rules, tuning and CI/CD integration.

o   Improved AppSec controls, pipeline security gates, secure coding guidance and a practical threat-modelling approach.

o   Contribution to training material and awareness plans that help developers integrate security practices.

What you will NOT be doing

o   You shall not act as a purely governance or assessment profile: the focus is on delivery and concrete remediation.

Requirements

Requirements & Qualifications:

As a candidate for this mission, you can demonstrate proven experience with similar projects, missions or employments, with skills that encompass:

o   5+ years of cybersecurity experience, including 3+ years in hands-on Application Security / DevSecOps.

o   Proven experience working with development teams, remediating vulnerabilities and reducing substantial backlogs.

o   Experience integrating and tuning security controls in CI/CD within a complex enterprise environment.

o   Technical knowledge:

▪        OWASP Top 10, API Security Top 10 and ASVS; CWE/CVSS

▪        Web/API security; OAuth2/OIDC/JWT

▪        Threat modelling and secure design

▪        Hands-on use of SAST, SCA, DAST and secrets detection, plus container and Infrastructure-as-Code security

▪        CI/CD integration with GitHub, GitLab, Azure DevOps, Jenkins or equivalent

▪        Tools such as Checkmarx, Fortify, Snyk, SonarQube, Veracode, Mend, GitHub Advanced Security, Burp Suite or similar

▪        Able to