Application Security Engineer - BSTD

Detailed description

The successful candidate will be responsible for the following key performance areas:

• Consult stakeholders to understand the expected outputs of applications and software, identify appropriate security controls and achieve an optimal balance between security, functionality and performance.
• Incorporate the identified security controls into technical specifications and documentation to ensure secure deployment, as agreed with stakeholders.
• Develop test plans and design appropriate security software tests to adequately secure applications and software.
• Perform security testing in accordance with agreed and approved test plans, using SARB Group-approved tools, to ensure that security controls meet requirements and align with security standards at each stage of the project development life cycle.
• Collate, document, analyse and report security testing results to identify secure-coding vulnerabilities and application security configuration errors.
• Use vulnerability assessment reports to validate the secure deployment of applications and software within the SARB Group environment, including networks and operating systems.
• Participate in application security audits by providing relevant information and responding to and addressing security-related audit findings, thereby reducing the SARB’s threat landscape and improving its application security posture.
• Keep abreast of cybersecurity technologies, developments and practices.

Qualifications

Job requirements

To be considered for this position, candidates must have:

• a National Diploma (NQF 6) in information technology or an equivalent qualification in a related field;
• three to five years’ relevant experience in a cybersecurity operations environment, with a focus on designing and implementing manual and automated security software tests and maintaining the relevant technologies; and 
• relevant intermediate cybersecurity certifications, such as CompTIA CySA+, Certified Application Security Engineer (CASE) and technology-specific certifications will be advantageous.

Additional requirements include:

knowledge and skills in:

• industry, organisational and business awareness;
• quality assurance;
• continuous improvement;
• continuous learning and professional development;
• DevSecOps practices and tools for integrating security into CI/CD pipelines;
• the design, development and implementation of security software tests; 
• automated testing tools; 
• systems and networking; 
• application and software testing processes; 
• operations; and
• the secure software development life cycle (SSDLC).