Responsibilities
- Lead or assist in evaluating the security posture of applications developed internally, by third parties, or delivered via SaaS, cloud, web, mobile, or API platforms.
- Conduct reviews of source code to identify security flaws and offer practical guidance for fixing issues such as authentication weaknesses, authorization flaws, input validation errors, exposed secrets, vulnerable dependencies, API misuse, logging deficiencies, and improper configurations.
- Collaborate with software development teams to integrate secure coding methods across all phases of the software development lifecycle, including threat modeling, design evaluations, peer review protocols, and pre-release security checks.
- Manage and enhance tools used for application security, including static and dynamic analysis, software composition analysis, container and infrastructure-as-code scanning, secrets detection, API protection, and CI/CD pipeline safeguards.
- Analyze application designs, data pathways, cloud deployment strategies, and integration architectures to detect potential security risks prior to production rollout.
- Convert identified vulnerabilities into prioritized, risk-informed remediation strategies and collaborate with application owners, developers, DevOps, and product teams to ensure resolution.
- Harden application-level configurations involving encryption, session handling, authentication mechanisms, authorization logic, logging practices, error responses, secure HTTP headers, CORS policies, API gateways, and secrets handling.
- Provide input on cloud security controls for platforms like Azure, AWS, or GCP, covering identity management, network isolation, workload protection, logging, storage security, key management, and policy-as-code implementation.
- Guide teams in adopting DevSecOps principles such as secure CI/CD pipelines, branch protection rules, dependency governance, signed artifacts, container hardening, and separation of environments.
- Work with security operations teams during application-related incidents, including investigation of suspicious behavior, exploit attempts, and validation of corrective actions.
- Assist in vulnerability management by confirming exploit feasibility, minimizing false positives, recording compensating controls, and maintaining records of remediation efforts.
- Create and maintain standards for application security, including secure coding guidelines, architectural patterns, checklists, operational procedures, and technical documentation.
- Support compliance audits by supplying evidence related to secure development practices, change control processes, access management, logging, vulnerability fixes, and cloud security measures.
- Train and mentor developers, security analysts, and IT staff on application security principles and effective remediation techniques.
