Application Security և Secure Development

Job Description

• Participate in the design, implementation, and continuous development of Application Security, Secure SDLC, and DevSecOps processes across the Bank, including the development of the necessary technical controls, tools, integrations, and workflows.
• Participate in designing and implementing the Secure Software Development Lifecycle (Secure SDLC), embedding information security requirements throughout all stages of the software development lifecycle: Requirements, Design, Development, Testing, Deployment, and Maintenance.
• Conduct security assessments of the Bank’s new and existing web applications, APIs, backend/frontend components, and other software solutions.
• Perform Source Code Security Reviews to identify security vulnerabilities, insecure coding practices, misconfigurations, and other security issues in software code.
• Perform and enhance SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), SCA (Software Composition Analysis), Secret Scanning, and other Application Security assessments.
• Analyze the results of SAST, DAST, SCA, and other AppSec tools, conducting triage and validation to distinguish genuine vulnerabilities from false positives.
• Classify identified Application Security vulnerabilities and prioritize them based on severity, exploitability, application criticality, data sensitivity, and potential business impact.
• Coordinate the assignment of identified vulnerabilities to the relevant development teams, monitor remediation progress, and conduct retesting and verification.
• Participate in Code Review processes from an information security perspective, with particular attention to OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, and Secure Coding principles.
• Analyze third-party libraries, packages, and other dependencies used in software solutions to identify known vulnerabilities, risky components, and outdated dependencies.
• Provide developers with practical technical recommendations regarding the root causes of identified vulnerabilities and how to remediate them.
• Participate in Architecture/Design Security Reviews for new applications, services, and significant changes to identify security issues as early as possible in the development process.
• Participate in establishing and conducting Threat Modeling processes to identify potential threat actors, attack surfaces, trust boundaries, attack scenarios, and required security controls.
• Assess the implementation of Authentication, Authorization, Access Control, Session Management, Input Validation, Cryptography, Secrets Management, Logging, Error Handling, and other Application Security mechanisms.
• Assess API security mechanisms, including Authentication/Authorization, Object/Function-Level Access Control, Input Validation, Rate Limiting, and other relevant controls.
• Participate in manual security testing of web applications and APIs to validate automated tool findings and identify additional security issues.
• Participate in developing and continuously improving Secure Coding Standards, Application Security Requirements, checklists, and Developer Security Guidelines.

DevSecOps and CI/CD Security

• Participate in establishing and developing DevSecOps processes across the Bank by integrating and automating security checks as extensively as possible throughout software development and delivery workflows.
• Participate in designing, assessing, and continuously improving the security of CI/CD pipelines.
• Integrate SAST, DAST, SCA, Secret Scanning, and other Application Security checks into CI/CD pipelines.
• Participate in developing and implementing Security Quality Gates, defining appropriate security criteria for the Build, Test, and Deployment stages.
• Participate in implementing security controls for repositories and CI/CD pipelines, including Access Control, Branch Policies, Pull Request/Code Review Requirements, Pipeline Permissions, and other relevant mechanisms.
• Participate in establishing processes for the secure use of and access control over CI/CD service accounts, service connections, tokens, credentials, and secrets.
• Participate in implementing processes to detect and securely manage passwords, API keys, tokens, certificates/private keys, and other secrets in source code, repositories, and CI/CD pipelines.
• Participate in selecting, conducting Proofs of Concept (PoCs), testing, implementing, configuring, integrating, and administering Application Security tools.
• Configure and improve AppSec tool rules, policies, profiles, and scan configurations to reduce false positives and improve detection quality.
• Participate in integrating Application Security tools with task/issue management systems and other relevant platforms.
• Participate in establishing and developing Docker Container Security processes, including Container Image Scanning, Base Image Security, Dependency Analysis, Secrets Detection, and Container Configuration Security.
• Participate in defining requirements for using secure base images and establishing security controls throughout the container image lifecycle.
• Develop scripts, integrations, and automation solutions to automate Application Security and DevSecOps processes and improve their efficiency.

Application Security Vulnerability Management

Participate in establishing and developing the Application Security Vulnerability Management process, ensuring end-to-end management of identified issues throughout their lifecycle: Detection → Validation → Prioritization → Remediation → Retest → Closure.

Ensure the consistent recording and traceability of Application Security issues identified through SAST, DAST, SCA, Code Review, Security Testing, and other sources.

Assess the technical and business impact of identified vulnerabilities, taking into account CVSS, CWE, exploitability, application criticality, and other relevant factors.

Collaborate with Development, DevOps, QA, Infrastructure, Security Engineering, and Security Testing/Penetration Testing teams to implement security requirements and remediate identified issues.

Participate in developing and collecting Application Security metrics/KPIs, including Security Scan Coverage, Vulnerability Severity, Remediation Time, Open/Closed Vulnerabilities, and other relevant indicators.

Prepare technical and periodic reports on the state of Application Security, identified vulnerabilities, risks, and completed activities.

Participate in organizing Secure Coding/Application Security Awareness initiatives for developers and other technical teams.

Monitor emerging Application Security threats, vulnerabilities, CVEs/CWEs, attack techniques, and Secure Development Practices, applying relevant knowledge to the Bank’s Application Security and DevSecOps processes.

Required Education and Skills

• Prior Application Security/DevSecOps work experience is not mandatory for Junior-level candidates, provided they have relevant technical knowledge and practical skills acquired through a home lab, training programs, internships, personal projects, or other hands-on activities.
• For Middle-level candidates, at least two years of relevant experience in Application Security, DevSecOps, Software Development, DevOps, Penetration Testing, or a related field is preferred.
• A university degree in Information Security, Cybersecurity, Software Development, Information Technology, Computer Science, or a related field, or equivalent professional experience.
• Good understanding of Web Application and API architecture fundamentals.
• Knowledge of HTTP/HTTPS, TLS, DNS, cookies, sessions, headers, and the fundamental mechanisms of web communication.
• Understanding of the core principles of Authentication, Authorization, Access Control, Session Management, and Identity Security.
• Knowledge of OWASP Top 10 and common Web Application Security vulnerabilities and attack classes, including Injection, Cross-Site Scripting (XSS), Broken Access Control, SSRF, and authentication/session-related issues.
• Knowledge of OWASP API Security Top 10 and the key security risks specific to APIs.
• General understanding of OWASP ASVS and Application Security controls.
• Understanding of Secure Coding principles and the main causes of security issues in software code.
• Ability to read and analyze source code from a security perspective in at least one programming language or technology stack, such as .NET/C#, Node.js/JavaScript, React, PHP, or another equivalent technology.
• Knowledge of Git and version control fundamentals, including branching, Pull Requests, and Code Review processes.
• Understanding of the fundamental principles of CI/CD processes and pipeline operations.
• Knowledge of how SAST, DAST, SCA, and Secret Scanning tools work and how their purposes differ.
• Understanding of software dependencies, package managers, third-party/open-source components, and related security risks.
• Knowledge of Secrets Management and the fundamental principles of securely managing credentials in source code, repositories, and CI/CD environments.
• Understanding of Docker containers, images, registries, and Container Security fundamentals.
• Basic working knowledge of Linux and Windows systems.
• Understanding of Vulnerability Management processes and the fundamental principles of assessing vulnerability severity and priority.
• Knowledge of CVE, CWE, and CVSS concepts and their basic applications.
• Basic practical skills in using Burp Suite, OWASP ZAP, or equivalent Web Security Testing tools.
• Practical knowledge of at least one scripting/programming language, such as Python, PowerShell, Bash, C#, JavaScript/Node.js, or an equivalent language.
• Ability to analyze technical issues, identify their root causes, and provide developers with practical remediation recommendations.
• Sufficient English proficiency to read technical documentation, security advisories, CVEs, tool documentation, and other professional materials.
• Analytical thinking, attention to detail, willingness to learn independently, and the ability to collaborate effectively with Development, DevOps, QA, IT, and Information Security teams.
• Ability to comply with established Change Management processes, Access Control requirements, and defined responsibilities when working with production environments, source code, and CI/CD processes.

Will Be Considered an Advantage

Practical work experience in Application Security, DevSecOps, Secure Software Development, DevOps, Software Development, or Penetration Testing.

Hands-on experience with Azure DevOps, including Repositories, Pipelines, Branch Policies, Pull Requests, Service Connections, and relevant Access Control mechanisms.

Experience conducting Source Code Security Reviews.

Experience with Semgrep, SonarQube/SonarCloud, Checkmarx, Fortify, or equivalent SAST solutions.

Experience with OWASP ZAP, Burp Suite Professional, Invicti/Acunetix, or equivalent DAST solutions.

Experience with Snyk, Mend, OWASP Dependency-Check, or equivalent SCA/Dependency Scanning solutions.

Experience with Gitleaks, TruffleHog, or equivalent Secret Scanning solutions.

Experience with Trivy, Grype, or equivalent Container/Image Security Scanning tools.

Experience integrating SAST/DAST/SCA/Secret Scanning tools into CI/CD pipelines and implementing Security Quality Gates.

Experience conducting Source Code Security Reviews and providing Secure Coding/remediation recommendations for identified issues.

Practical experience in Web Application and API Security Testing.

Experience with Threat Modeling processes and the STRIDE methodology or equivalent approaches.

Knowledge of the security aspects of OAuth 2.0, OpenID Connect, JWT, SAML, and modern Authentication/Authorization mechanisms.

Practical experience with Docker and Container Security.

Experience implementing Security Automation through APIs, webhooks, CLI tools, and other integration mechanisms.

Experience developing scripts and automation tools for AppSec/DevSecOps processes using Python, PowerShell, Bash, C#, or JavaScript/Node.js.

Knowledge of or practical experience with Kubernetes, container orchestration technologies, and their security.

Knowledge of or practical experience with Cloud Security in Microsoft Azure, AWS, or other cloud environments.

Knowledge of or practical experience with Infrastructure as Code (IaC) and Terraform, Ansible, or equivalent technologies.

Participation in Bug Bounty programs and practical experience identifying real Web/API vulnerabilities.

Experience in Application Security/DevSecOps within banking, financial services, or other regulated organizations.

Knowledge of PCI DSS, OWASP ASVS, OWASP SAMM, the NIST Secure Software Development Framework (SSDF), or other Secure Development frameworks and standards.

Professional certifications such as eWPT/eWPTX, Burp Suite Certified Practitioner (BSCP), HTB CWEE, OSWE, or equivalent Application Security/DevSecOps certifications. CKS or an equivalent Container/Cloud Security certification will be considered an additional advantage.

Hands-on training and skills development through specialized platforms such as PortSwigger Web Security Academy, Hack The Box, TryHackMe, PentesterLab, Microsoft Learn, OWASP, OffSec, or equivalent platforms. Completed labs, challenges, CTFs, Bug Bounty results, published write-ups, GitHub projects, and other practical achievements will be considered additional advantages.

What We Expect from the Candidate

A genuine practical interest in both Application Security and DevSecOps, along with the ability not only to assess software development processes from a security perspective but also to integrate security controls into those processes in a practical manner.

The role is not limited to reviewing the results of existing SAST/DAST scans. The specialist will participate in building Application Security and DevSecOps processes, from establishing Secure SDLC and conducting Source Code Security Reviews to implementing automated Security Testing, Security Quality Gates, Dependency/Secret Scanning, and other controls within CI/CD pipelines.

Junior-level candidates are expected to have a solid technical foundation, knowledge of Web/Application Security and Software Development processes, the ability to understand source code, and a willingness to develop in both Application Security and DevSecOps.

Middle-level specialists are expected to independently analyze Application Security issues, conduct Source Code Security Reviews, validate SAST/DAST/SCA findings, perform Threat Modeling, assess vulnerabilities, and coordinate remediation with Development teams. They are also expected to take an active and independent role in establishing Secure SDLC and DevSecOps processes by designing, implementing, and improving CI/CD Security Controls, Security Quality Gates, AppSec Tooling, Automation, and other relevant mechanisms.

Any work involving production environments, CI/CD systems, or source code must be carried out within established authorization limits and in compliance with Change Management processes and defined responsibilities, without making unauthorized changes.

Application period

Start date: September 2, 2026

Closing date: October 15, 2026