SrMgr-Information Security - Application Security

JOB SUMMARY

 

The Sr. Application Security Manager is responsible for the oversight of the security components of web application projects, ensuring adherence to both internal standards and external regulations. This role will manage, track and drive remediation of application security risks, collaborate with development teams, and utilize project management tools effectively to ensure timely execution and compliance. The position plays a critical role in helping to ensure that the company’s risk-taking entities are aware of the risks inherent in their activities and decisions, the impact of their actions on the company at an enterprise level, and opportunities to reduce, mitigate, or avoid risks altogether.

 

CANDIDATE PROFILE

 

Education and Experience

 

Required:

• Bachelor’s degree in Cybersecurity, Computer Sciences or related field or equivalent experience/certification
• 7+ years of progressive information technology/information security experience with several years of team leadership or supervisory/management experience
• 3+ years of experience with Application Security testing methodologies (SAST, DAST, IAST, MPT)
• 2+ years’ experience working in programming languages such as Java, C++, Go, PHP
• 2+ years’ experience with JavaScript and at least one JavaScript framework (e.g., Angular, React, Vue)
• 1+ years hands-on experience with:
  • OWASP ASVS and OWASP WSTG and their applications to large enterprise environments
  • MITRE CVE, CWE, CAPEC and ATT&CK
  • Performing secure code reviews, issue triage and determining the efficacy of remediation approaches.
  • Experience with common GitHub operations (e.g., cloning, branching, merging, pull requests)
  • Experience with JIRA and ServiceNow 

 

Preferred:

• Master’s degree in Cybersecurity, Computer Sciences or related field or equivalent experience/certification
• Current information security certification, including: GPEN, GWAPT, OSCP, OSWE
• Certified Scrum Master (CSM) and/or Project Management Professional (PMP)
• Demonstratable working knowledge of common risk management frameworks such as: FAIR, NIST RMF, MITRE TARA, OCTAVE
• Technical leadership experience in a highly regulated environment
• Project management skills with a demonstrated ability to work independently and with others
• Software engineering background with a focus on web application development
• Demonstratable working knowledge of SAFe practices, principals, and roles.
• Experience using the following security tools: GitHub Advanced Security (CodeQL, Dependabot, Secret Scanner), Tenable.io, Aqua CSP and Contrast Asses.

 

CORE WORK ACTIVITIES

 

Application Security Risk Management & Tracking

• Conducts assessments of threats and vulnerabilities, determine deviations from acceptable configurations or enterprise or local policy, assesses the level of risk, and develop and/or recommend appropriate mitigation countermeasures.
• Assesses and prioritize security risks associated with applications and develop risk mitigation strategies.
• Monitors and evaluates emerging threats and vulnerabilities, recommending proactive measures to mitigate risks.
• Continuously monitors application security risks, ensuring timely follow-ups on identified vulnerabilities and implementing effective solutions.
• Develops and implements security metrics that provide insights into the effectiveness of security measures, track progress, and identify areas for improvement.
• Maintains effective communication with all stakeholders, providing regular updates on risk status, project progress, and compliance through concise reports and presentations.
• Articulates complex security concepts in easy-to-understand language to both technical and non-technical stakeholders .
• Leads and mentors a team dedicated to application security, promoting continuous learning and improvement in secure coding practices and risk management.
• Stays current on emerging cyber and technology threats and potential implications.
• Coordinates program-related activities and deliverables to ensure effective collaboration within the team and across stakeholder groups.
• Adapts self and team to a rapidly changing organization 
• Provides strategic leadership and collaborates to manage the organization’s Cybersecurity risk oversight initiatives
• Provides subject matter expertise in cybersecurity, to include maintaining and sharing knowledge of current and emerging cyber risk management practices and tools.
• Advocates for policy changes and creates