Application Security Engineer

Assess what the current pipeline actually catches versus what it produces as noise, and fix the ratio before adding more scanners

Own supply chain posture: dependency pinning, SBOM, internal registry, and the response process when a package gets compromised

Own secrets detection and remediation end-to-end

Translate application security gaps into language that satisfies BSP examiners without over-engineering the evidence

Coordinate security input into new product launches across our Group and Bank structure

7+ years in application security, with meaningful ownership over both technical work and process

Has built or substantially improved a secure SDLC in a fast-moving product org

Has run threat modeling on real product features and influenced design decisions as a result

Has owned vulnerability management end-to-end: triage, remediation tracking, SLA management, risk acceptance

Has done hands-on mobile security testing (iOS and/or Android) in a production context, not just UAT

Understands modern supply chain attack vectors like compromised packages (npm, PyPI), malicious IDE plugins, typosquatting, dependency confusion - and knows how to reduce exposure at the tooling and process level

Comfortable writing Python or Bash to automate repetitive security work

Experience in a regulated environment (financial services or similar)

Familiarity with PCI-DSS, ISO 27001, or BSP MORB

Certifications: OSCP, GWEB, GWAPT, CSSLP

Strong written English; most day-to-day alignment is async

Can explain a security issue clearly to an engineer and summarize the same issue for a non-technical stakeholder