Manager - AppSec/DevSecOps Security Engineer

Role Overview

Leadership and Programme Management

• Lead and mentor AppSec engineers and penetration testers.
• Manage workload, quality, career development, client discussions, audits, risk committees, and vendor assessments.
• Own AppSec strategy, service catalogue, risk decisions, and continuous improvement.

Security Testing

• Oversee advanced web application penetration testing covering business logic, authentication, authorization, API abuse, and chained attacks.
• Lead Android and iOS security assessments, including static and dynamic analysis, reverse engineering, and runtime manipulation.
• Conduct and oversee manual source code security reviews across multiple programming languages.
• Review penetration test reports and drive responsible disclosure and vulnerability management.

DevSecOps Integration

• Integrate SAST, DAST, SCA, container scanning, and API security into CI/CD pipelines.
• Define security gates, policy-as-code standards, developer feedback loops, and secure architecture controls.
• Oversee infrastructure-as-code security, secrets management, supply-chain security, and runtime protection.

Governance and Risk

• Maintain the application security risk register and report vulnerability posture to senior leadership.
• Align AppSec activities with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2.
• Define and track remediation, release, and coverage metrics.

AI and GenAI Security

• Assess risks in LLM applications, RAG pipelines, and agentic workflows.
• Test for prompt injection and data leakage and incorporate AI security into AppSec methodologies.

Non-Negotiable Qualifications

• 6–8+ years of progressive application security, penetration testing, or related security engineering experience.
• Expert web application penetration testing capabilities.
• Hands-on Android and iOS security testing experience.
• Strong source code review and SAST tooling experience.
• Experience embedding security into CI/CD pipelines.
• Experience managing or technically leading security engineers or penetration testers.
• Ability to communicate security risk to technical and executive audiences.

Preferred Qualifications

• Offensive security certifications such as eWPTX, OSCP, OSWE, BSCP, GWAPT, GWEB, GPEN, or CPENT are strongly preferred.
• Cloud security, AI/GenAI security, threat modelling, and client-facing consulting experience are advantageous.

Education and Experience

• Bachelor’s or master’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
• 1–2+ years of team lead or management experience within a security function.