Job Purpose

The Application Security Specialist safeguards the bank’s internally developed and third-party applications by embedding security throughout the software development lifecycle and supporting the timely identification and remediation of vulnerabilities. The role works closely with development, infrastructure and risk teams to strengthen application security controls and promote secure development practices.

Through application security assurance, incident response support and alignment with regulatory requirements and internal security standards, the role helps protect sensitive information, reduce cyber risk and maintain reliable banking services, enabling secure digital innovation and sustaining customer trust.

Key Result Areas

Application Security Assessments

Conduct thorough security testing (SAST, DAST, code reviews) on in-house and third-party applications to identify vulnerabilities.

Vulnerability Management and Remediation Support

Analyse, prioritize, and track remediation of application security issues in collaboration with development and infrastructure teams.

Secure Development Lifecycle (SDLC) Integration

Integrate security requirements into SDLC processes, guiding developers on secure coding standards and threat modelling.

Security Tool Management and Optimization

Implement, manage, and fine-tune security tools like SAST, DAST, SCA, and other vulnerability scanning solutions.

Incident Response and Forensics

Support investigation and analysis of security incidents involving applications, contributing to root-cause analysis and mitigation strategies.

Compliance and Policy Adherence

Ensure applications align with regulatory requirements and internal security standards (e.g. PCI DSS, GDPR, OWASP Top 10).

Documentation and Reporting

Maintain clear, comprehensive security documentation, vulnerability reports, and metrics to communicate application security posture.

Security Awareness and Knowledge Sharing

Provide training and guidance to development and technical teams to enhance secure development practices and promote security culture.

Conduct security assessments on internally developed and third-party applications, including code reviews, static and dynamic analysis, and vulnerability scanning.

Identify, analyze, and report vulnerabilities in applications and work with development and infrastructure teams to ensure timely remediation.

Review configurations and logs of application servers, web servers, databases, and middleware components for compliance with security policies and standards.

Oversee the implementation and management of application security tools, such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and vulnerability scanners.

Collaborate with developers to integrate security into the software development lifecycle (SDLC), providing guidance on secure coding practices.

Develop and maintain security baselines and hardening guidelines for applications and related systems.

Participate in threat modeling exercises and design reviews for new applications or significant changes to existing systems.

Review activities of privileged access on application systems and ensure proper user access controls and segregation of duties.

Investigate security incidents related to applications, conduct root-cause analysis, and contribute to incident response efforts.

Document application security procedures, standards, and reports, ensuring alignment with regulatory requirements and internal policies.

Support compliance efforts by ensuring application environments meet standards such as PCI DSS, GDPR, and local banking regulations.

Track and report metrics related to application vulnerabilities, remediation efforts, and security testing outcomes.

Participate in training and knowledge sharing to promote secure development practices across the bank’s technology teams.

Stay updated on emerging threats, vulnerabilities, and security technologies relevant to applications.

• Conduct thorough security testing (SAST, DAST, code reviews) on in-house and third-party applications to identify vulnerabilities.
• Analyse, prioritize, and track remediation of application security issues in collaboration with development and infrastructure teams.
• Integrate security requirements into SDLC processes, guiding developers on secure coding standards and threat modelling.
• Implement, manage, and fine-tune security tools like SAST, DAST, SCA, and other vulnerability scanning solutions.
• Support investigation and analysis of security incidents involving applications, contributing to root-cause analysis and mitigation strategies.
• Ensure applications align with regulatory requirements and internal security standards (e.g. PCI DSS, GDPR, OWASP Top 10).
• Maintain clear, comprehensive security documentation, vulnerability reports, and metrics to communicate application security posture.
• Provide training and guidance to development and technical teams to enhance secure development practices and promote security culture.
• Conduct security assessments on internally developed and third-party applications, including code reviews, static and dynamic analysis, and vulnerability scanning.
• Identify, analyze, and report vulnerabilities in applications and work with development and infrastructure teams to ensure timely remediation.
• Review configurations and logs of application servers, web servers, databases, and middleware components for compliance with security policies and standards.
• Oversee the implementation and management of application security tools, such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and vulnerability scanners.
• Collaborate with developers to integrate security into the software development lifecycle (SDLC), providing guidance on secure coding practices.
• Develop and maintain security baselines and hardening guidelines for applications and related systems.
• Participate in threat modeling exercises and design reviews for new applications or significant changes to existing systems.
• Review activities of privileged access on application systems and ensure proper user access controls and segregation of duties.
• Investigate security incidents related to applications, conduct root-cause analysis, and contribute to incident response efforts.
• Document application security procedures, standards, and reports, ensuring alignment with regulatory requirements and internal policies.
• Support compliance efforts by ensuring application environments meet standards such as PCI DSS, GDPR, and local banking regulations.
• Track and report metrics related to application vulnerabilities, remediation efforts, and security testing outcomes.
• Participate in training and knowledge sharing to promote secure development practices across the bank’s technology teams.
• Stay updated on emerging threats, vulnerabilities, and security technologies relevant to applications.

• SAST
• DAST
• Code Reviews
• Vulnerability Management
• SDLC Integration
• Secure Coding Standards
• Threat Modelling
• Security Tool Management
• SCA
• Vulnerability Scanning
• Incident Response
• Forensics
• Compliance
• PCI DSS
• GDPR
• OWASP Top 10
• Documentation
• Reporting
• Security Awareness
• Knowledge Sharing
• Application Security Assessments
• Static Analysis
• Dynamic Analysis
• Server Configuration Review
• Log Review
• Security Baselines
• Hardening Guidelines
• Threat Modeling Exercises
• Design Reviews
• Privileged Access Review
• User Access Controls
• Segregation of Duties
• Root-Cause Analysis
• Mitigation Strategies
• Regulatory Requirements
• Internal Policies
• Metrics Tracking

• Experience in application security assessments, including code reviews, static and dynamic analysis, and vulnerability scanning.
• Ability to identify, analyze, and report vulnerabilities in applications.
• Experience working with development and infrastructure teams to ensure timely remediation of security issues.
• Familiarity with reviewing configurations and logs of application servers, web servers, databases, and middleware components.
• Experience overseeing the implementation and management of application security tools (SAST, DAST, SCA, vulnerability scanners).
• Ability to collaborate with developers to integrate security into the SDLC and provide guidance on secure coding practices.
• Experience developing and maintaining security baselines and hardening guidelines.
• Participation in threat modeling exercises and design reviews.
• Experience reviewing privileged access activities and ensuring proper user access controls and segregation of duties.
• Ability to investigate security incidents, conduct root-cause analysis, and contribute to incident response efforts.
• Experience documenting application security procedures, standards, and reports.
• Knowledge of compliance standards such as PCI DSS, GDPR, and local banking regulations.
• Ability to track and report metrics related to application vulnerabilities and security testing outcomes.
• Experience in training and knowledge sharing to promote secure development practices.
• Up-to-date knowledge of emerging threats, vulnerabilities, and security technologies relevant to applications.