Application Security Manager
SKILLS
FULL DESCRIPTION
As we continue to expand our market share in the rapidly emerging Employee Experience platform category, we are looking for an Application Security Manager. This role is responsible for building and executing a comprehensive application security programme that combines strategic oversight with hands-on technical execution. The Application Security Manager ensures that security is embedded throughout the software development lifecycle (SDLC), enabling [Employer hidden — view at passion-project.co.uk] to deliver secure products at speed.
Job Purpose
As we continue to expand our market share in the rapidly emerging Employee Experience platform category, we are looking for an Application Security Manager. This role is responsible for building and executing a comprehensive application security programme that combines strategic oversight with hands-on technical execution. The Application Security Manager ensures that security is embedded throughout the software development lifecycle (SDLC), enabling [Employer hidden] to deliver secure products at speed.
The Application Security Manager will define and enforce secure development policies and practices, establish privacy by design principles, and mange the risk and escalation process. They will actively engage in technical assurance activities such as threat modelling, application testing, dependency analysis, cloud and container security assessments and CI/CD pipeline hardening.
The role will act as both a strategic partner to leadership and a trusted advisor to engineering teams, being a customer facing point of contact when required.
Main Responsibilities
- Define and maintain secure development policies and privacy by design requirements
- Own the risk acceptance and escalation process, maintaining the risk register
- Develop and measure the application security strategy levering frameworks such as OWASP SAMM
- Support RFPs and sales responses on application security matters
- Lead and coordinate external penetration testing engagements and remediation follow up
- Drive risk-based prioritisation, assigning and validating CVSS scores
- Deliver and manager secure development training programs
- Conduct and facilitate threat modelling and architecture and design security reviews
- Perform or coordinate application security testing
- Generate and manage software bills of materials (SBOMs) to manage supply chain risks
- Ensure build verification and oversee IaC and container/Kubernetes scanning within pipelines
- Provide guidance on secure cloud-native architectures
- Evaluate and apply security testing tools and techniques (e.g. Burpsuite, fuzzing, IaC scanners, Static Analysers)
- Contribute to security metrics, reports and dashboards
- Collaborate with engineering, operations and product teams to embed security best practices throughout the whole SDLC
Requirements
- Proven experience in application security
- Strong knowledge of secure software development practices, DevSecOps and CI/CD security integration
- Hands on experience with application security testing tools and techniques (e.g. SAST, DAST, Dependency checkers, IaC scanners, secret detection, container security tools)
- Understanding of threat modelling, architecture and design reviews and offensive security principles
- Familiarity with compliance and regulatory frameworks
- Experience with risk acceptance processes, CVSS scoring and vulnerability management
- Experience managing external penetration testing vendors
- Familiarity with SBOMs and software supply chain security
- Strong background in cloud and container security
- Ability to communicate with technical and non-technical stakeholders
- Knowledge of data privacy regulations and GDPR, and how they intersect with application security
- Certifications such as CISSP, CSSLP, OSWE, OSCP or equivalents
- Degree in computer science, cyber security, related fields or equivalent experience