Lensys MarketplaceMissions
Lensys
Suivez-nous

Lead Application Security Engineer

This pivotal role leads the charge in fortifying a vast application landscape, transforming security practices from manual to automated excellence. You will define and implement cutting-edge security standards, integrating them seamlessly into DevSecOps pipelines to protect critical digital assets.

CONTEXT

Imagine a sprawling digital ecosystem, a network of nearly a thousand applications serving as the backbone for essential public services and critical infrastructure. For years, the guardians of this digital realm have worked diligently, but the evolving threat landscape demands a revolution in how security is approached. Our client, a major player in its sector, is embarking on a transformative journey, shifting from reactive, manual security measures to a proactive, automated, and risk-proportionate Secure Application Lifecycle Management (SALM) program. This isn't just about patching vulnerabilities; it's about embedding security as a first-class citizen in every stage of development, building a fortress from within. You will be the architect and leader of this critical transformation, safeguarding the integrity and continuity of services that touch the lives of millions. This role offers the unique opportunity to define the future of application security for an organization that truly impacts society.

ACTIVITIES

  • Lead and mentor a team of security specialists, fostering a culture of continuous improvement and security-first development.
  • Define and champion robust application security standards, policies, and guidelines across the entire software development lifecycle.
  • Strategically integrate automated security controls (SAST, DAST, SCA) into existing DevSecOps and CI/CD pipelines.
  • Conduct comprehensive application risk analyses, identifying potential vulnerabilities and their business impact.
  • Oversee the management and remediation of identified vulnerabilities, collaborating closely with development teams.
  • Ensure rigorous compliance with evolving regulatory frameworks such as NIS2, CyFun, and internal information security programs.
  • Drive the adoption of best practices for secure coding, threat modeling, and security testing.

EXPECTED ACHIEVEMENTS

  • Establish a mature, automated, and scalable Secure Application Lifecycle Management (SALM) framework, significantly reducing reliance on manual security interventions.
  • Achieve demonstrable improvements in the overall security posture of the application portfolio, evidenced by reduced vulnerability counts and improved compliance scores.
  • Successfully transition development teams towards a DevSecOps model where security is inherently built-in, not bolted on.
  • Cultivate a strong security-aware culture across engineering and product teams.
  • Become the go-to expert and thought leader for application security within the organization, guiding strategic decisions and future initiatives.
  • Contribute directly to the resilience and trustworthiness of critical public digital services, protecting against service interruptions and data compromise.

ENVIRONMENT

  • Methodologies: DevSecOps, Agile (Scrum/Kanban), ITIL, Risk Management frameworks.
  • Tools/Technologies: SAST (e.g., SonarQube, Checkmarx), DAST (e.g., OWASP ZAP, Burp Suite), SCA (e.g., Snyk, Mend), CI/CD platforms (e.g., Azure DevOps, GitLab CI, Jenkins), Containerization (Docker, Kubernetes), Cloud platforms (Azure preferred), Jira, Confluence.
  • Standards: OWASP Top 10, CWE, MITRE ATT&CK.
  • Compliance: NIS2, CyFun, GDPR, ISO 27001.