Manager - AppSec/DevSecOps Security Engineer

Leadership & Programme Management

• Own and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements.
• Lead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development.
• Act as the primary escalation point for application security risk decisions across engineering and product leadership.
• Drive continuous improvement in AppSec tooling, methodologies, and coverage metrics.
• Represent the AppSec function in client discussions, audits, risk committees, and vendor assessments.

Web Application Penetration Testing

• Oversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios.
• Define and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements.
• Review and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders.
• Drive responsible disclosure and coordinated vulnerability management for critical findings.

Mobile Application Security

• Lead mobile security assessments for Android and iOS—static/dynamic analysis, reverse engineering, and runtime manipulation (Frida, objection, Drozer).
• Establish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams.
• Guide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security.

Source Code Review

• Conduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others).
• Define code review standards and integrate SAST tooling (Semgrep, Checkmarx, Veracode, SonarQube) into development workflows.
• Provide actionable, developer-centric findings with clear severity ratings and remediation guidance.
• Track remediation SLAs and report on code security posture trends over time.

DevSecOps Integration

• Lead integration of security tooling (SAST, DAST, SCA, container scanning, API security) into CI/CD pipelines (Jenkins, GitHub Actions, and similar).
• Define pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left.
• Oversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls.
• Collaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection.

Governance, Risk & Compliance

• Own the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership.
• Ensure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2.
• Define and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates.
• Translate regulatory and client security requirements into testable engineering controls.

AI / GenAI Security

• Assess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows (OWASP LLM Top 10, prompt injection, data leakage).

Incorporate AI security testing into standard AppSec assessment methodologies.

Leadership & Programme Management

• Own and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements.
• Lead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development.
• Act as the primary escalation point for application security risk decisions across engineering and product leadership.
• Drive continuous improvement in AppSec tooling, methodologies, and coverage metrics.
• Represent the AppSec function in client discussions, audits, risk committees, and vendor assessments.

Web Application Penetration Testing

• Oversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios.
• Define and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements.
• Review and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders.
• Drive responsible disclosure and coordinated vulnerability management for critical findings.

Mobile Application Security

• Lead mobile security assessments for Android and iOS—static/dynamic analysis, reverse engineering, and runtime manipulation (Frida, objection, Drozer).
• Establish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams.
• Guide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security.

Source Code Review

• Conduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others).
• Define code review standards and integrate SAST tooling (Semgrep, Checkmarx, Veracode, SonarQube) into development workflows.
• Provide actionable, developer-centric findings with clear severity ratings and remediation guidance.
• Track remediation SLAs and report on code security posture trends over time.

DevSecOps Integration

• Lead integration of security tooling (SAST, DAST, SCA, container scanning, API security) into CI/CD pipelines (Jenkins, GitHub Actions, and similar).
• Define pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left.
• Oversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls.
• Collaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection.

Governance, Risk & Compliance

• Own the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership.
• Ensure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2.
• Define and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates.
• Translate regulatory and client security requirements into testable engineering controls.

AI / GenAI Security

• Assess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows (OWASP LLM Top 10, prompt injection, data leakage).

Incorporate AI security testing into standard AppSec assessment methodologies.

Skills & Capabilities

Non-Negotiable – Must Have

• 6–8+ years of progressive experience in application security, penetration testing, or a closely related security engineering discipline.
• Expert-level web application penetration testing: complex chained attacks, API abuse, OAuth/OIDC flaws, deserialization, advanced injection techniques.
• Hands-on mobile security testing for Android and iOS (static/dynamic analysis, Frida scripting, MASVS/MSTG alignment).
• Strong source code review skills across at least two major languages—able to identify security defects manually and via SAST tooling.
• Proven experience embedding security into CI/CD pipelines and operating SAST/DAST/SCA tooling in a DevSecOps environment.
• Experience managing or technically leading a team of security engineers or penetration testers.
• Ability to communicate complex security risk credibly to technical and executive audiences.

Good to Have

• Certifications: eWPTX, OSCP, OSWE, BSCP (Burp Suite Certified Practitioner), GWAPT, GWEB, GPEN, CPENT, or equivalent offensive security credentials.
• Cloud security experience across AWS, Azure, or GCP (IAM, network security, SIEM integration).
• Knowledge of AI/GenAI security risks and securing ML pipelines (MLSecOps).
• Threat modelling frameworks: STRIDE, PASTA, attack trees.
• Experience in client-facing security consulting or managed security services.

Leadership & Soft Skills

• Proven ability to build, mentor, and retain high-performing security teams.
• Strong programme management—able to manage concurrent assessments, client deliverables, and operational priorities.
• Influencing skills to drive secure-by-design adoption across engineering organisations without being a pure gatekeeper.
• Commercial awareness: able to balance thoroughness, risk, and delivery timelines.

Qualifications

• Bachelor’s or master’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
• 6–8+ years of relevant experience in application security, penetration testing, or DevSecOps with progressive responsibility.
• 1–2+ years in a team lead or management capacity within a security function.
• Offensive security certifications (eWPTX, OSCP, OSWE, or equivalent) strongly preferred.