Application Security Specialist x2 - BSTD

Detailed description

The successful candidate will be responsible for the following key performance areas:

• Conduct security assessments, including code reviews, vulnerability scans and penetration testing, to identify and remediate security vulnerabilities.
• Collaborate with development teams to integrate security best practices into the system development life cycle, including threat modelling, secure coding and security testing.
• Design and implement application security controls, frameworks and policies to protect against emerging threats.
• Identify security risks and vulnerabilities, analyse their impact and engage relevant stakeholders, including governance bodies and product owners, on relevant security solutions, and drive and monitor their implementation to mitigate and remediate security vulnerabilities.
• Participate in application security audits through the provision of relevant information, respond to and address security-related audit findings to reduce the SARB’s threat landscape and improve its application security posture.
• Participate in information technology (IT) security projects as the application security subject matter expert, ensuring compliance with security standards during each stage of the project development life cycle.
• Engage with the larger security community to gain new knowledge and adopt new security capabilities within the SARB’s IT security environment.
• Participate in the evaluation and implementation of security tools and technologies, including static and dynamic code analysis, vulnerability scanning and confidentiality management.
• Stay abreast of the latest security trends, vulnerabilities and attack techniques, and proactively apply this knowledge to improve the SARB’s security practices. 
• Implement major security incident response procedures during a security breach by investigating, reporting and providing recommendations to ensure the continuous improvement of security measures and avoid recurrence.
• Develop training material and deliver application security training to all key stakeholders, including developers, testers and business analysts, in support of applications and integration security awareness campaigns.
• Present periodic reports and analytics pertaining to the security landscape surrounding the designated business applications.

Qualifications

Job requirements

To be considered for this position, candidates must have:

• a bachelor’s degree in IT (NQF 7) or an equivalent qualification;
• a Certified Applications Security Engineer qualification;
• a Certified Ethical Hacker qualification;
• at least five to eight years’ experience in system development life cycle frameworks and solutions, of which at least three years in overall security governance best practice, frameworks and design, with hands-on experience in security tools such as DAST, SAST and SCA; and
• any additional security certifications, for example Certified Information Systems Security Professional, Certified Secure Software Life Cycle Professional, Offensive Security Certified Professional or GIAC Web Application Penetration Tester, will be an advantage.

Additional requirements include:

knowledge and skills in;

• cybersecurity, governance, risk and compliance;
• industry, organisational and business awareness;
• quality assurance;
• continuous improvement;
• continual learning and professional development;
• collaboration;
• system development life cycle design, testing and development;
• application support and maintenance;

cloud platforms, such as AWS, Azure and Google Cloud, and their security features;

• scripting languages, including Bash and Python, and automation frameworks;
• network security, encryption and identity management;
• IT enablement reporting; and
• problem-solving and analytical abilities.