Manager - AppSec/DevSecOps Security Engineer

Leadership & Programme Management • Own and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements. • Lead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development. • Act as the primary escalation point for application security risk decisions across engineering and product leadership. • Drive continuous improvement in AppSec tooling, methodologies, and coverage metrics. • Represent the AppSec function in client discussions, audits, risk committees, and vendor assessments. Web Application Penetration Testing • Oversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios. • Define and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements. • Review and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders. • Drive responsible disclosure and coordinated vulnerability management for critical findings. Mobile Application Security • Lead mobile security assessments for Android and iOS—static/dynamic analysis, reverse engineering, and runtime manipulation (Frida, objection, Drozer). • Establish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams. • Guide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security. Source Code Review • Conduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others). • Define code review standards and integrate SAST tooling (Semgrep, Checkmarx, Veracode, SonarQube) into development workflows. • Provide actionable, developer-centric findings with clear severity ratings and remediation guidance. • Track remediation SLAs and report on code security posture trends over time. DevSecOps Integration • Lead integration of security tooling (SAST, DAST, SCA, container scanning, API security) into CI/CD pipelines (Jenkins, GitHub Actions, and similar). • Define pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left. • Oversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls. • Collaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection. Governance, Risk & Compliance • Own the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership. • Ensure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2. • Define and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates. • Translate regulatory and client security requirements into testable engineering controls. AI / GenAI Security • Assess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows (OWASP LLM Top 10, prompt injection, data leakage). Incorporate AI security testing into standard AppSec assessment methodologies. Leadership & Programme Management • Own and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements. • Lead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development. • Act as the primary escalation point for application security risk decisions across engineering and product leadership. • Drive continuous improvement in AppSec tooling, methodologies, and coverage metrics. • Represent the AppSec function in client discussions, audits, risk committees, and vendor assessments. Web Application Penetration Testing • Oversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios. • Define and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements. • Review and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders. • Drive responsible disclosure and coordinated vulnerability management for critical findings. Mobile Application Security • Lead mobile security assessments for Android and iOS—static/dynamic analysis, reverse engineering, and runtime manipulation (Frida, objection, Drozer). • Establish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams. • Guide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security. Source Code Review • Conduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others). • Define code review standards and integrate SAST tooling (Semgrep, Checkmarx, Veracode, SonarQube) into development workflows. • Provide actionable, developer-centric findings with clear severity ratings and remediation guidance. • Track remediation SLAs and report on code security posture trends over time. DevSecOps Integration • Lead integration of security tooling (SAST, DAST, SCA, container scanning, API security) into CI/CD pipelines (Jenkins, GitHub Actions, and similar). • Define pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left. • Oversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls. • Collaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection. Governance, Risk & Compliance • Own the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership. • Ensure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2. • Define and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates. • Translate regulatory and client security requirements into testable engineering controls. AI / GenAI Security • Assess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows (OWASP LLM Top 10, prompt injection, data leakage). Incorporate AI security testing into standard AppSec assessment methodologies. Skills & Capabilities Non-Negotiable – Must Have • 6–8+ years of progressive experience in application security, penetration testing, or a closely related security engineering discipline. • Expert-level web application penetration testing: complex chained attacks, API abuse, OAuth/OIDC flaws, deserialization, advanced injection techniques. • Hands-on mobile security testing for Android and iOS (static/dynamic analysis, Frida scripting, MASVS/MSTG alignment). • Strong source code review skills across at least two major languages—able to identify security defects manually and via SAST tooling. • Proven experience embedding security into CI/CD pipelines and operating SAST/DAST/SCA tooling in a DevSecOps environment. • Experience managing or technically leading a team of security engineers or penetration testers. • Ability to communicate complex security risk credibly to technical and executive audiences. Good to Have • Certifications: eWPTX, OSCP, OSWE, BSCP (Burp Suite Certified Practitioner), GWAPT, GWEB, GPEN, CPENT, or equivalent offensive security credentials. • Cloud security experience across AWS, Azure, or GCP (IAM, network security, SIEM integration). • Knowledge of AI/GenAI security risks and securing ML pipelines (MLSecOps). • Threat modelling frameworks: STRIDE, PASTA, attack trees. • Experience in client-facing security consulting or managed security services. Leadership & Soft Skills • Proven ability to build, mentor, and retain high-performing security teams. • Strong programme management—able to manage concurrent assessments, client deliverables, and operational priorities. • Influencing skills to drive secure-by-design adoption across engineering organisations without being a pure gatekeeper. • Commercial awareness: able to balance thoroughness, risk, and delivery timelines. Qualifications • Bachelor’s or master’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience. • 6–8+ years of relevant experience in application security, penetration testing, or DevSecOps with progressive responsibility. • 1–2+ years in a team lead or management capacity within a security function. • Offensive security certifications (eWPTX, OSCP, OSWE, or equivalent) strongly preferred.