Application Security Team Lead - Vulnerability Assessment

We are seeking an experienced

Application Security - Team Lead to join our cybersecurity team. The ideal candidate will have strong expertise in Application Security, Secure Code Review, Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Secure SDLC practices. This role involves identifying application vulnerabilities, providing remediation guidance, mentoring junior engineers, and collaborating with development teams to integrate security throughout the software development lifecycle.

Work Model Hybrid : 2 days Work from Office and 3 days Work from Home.

Key Responsibilities

• Perform Static Application Security Testing (SAST) and Software Composition Analysis (SCA) across applications developed in multiple programming languages.
• Conduct manual secure source code reviews to identify security vulnerabilities and insecure coding practices.
• Analyze and validate security findings, prioritize risks, and provide remediation recommendations to development teams.
• Create Proof of Concepts (PoCs) to demonstrate the exploitability of critical vulnerabilities when required.
• Review application architecture from a security perspective and recommend appropriate security controls and improvements.
• Collaborate with Application Security, Development, and DevOps teams to integrate security into the Secure SDLC.
• Mentor and provide technical guidance to junior Application Security Engineers.
• Promote secure coding best practices and support developers in resolving security vulnerabilities.
• Contribute to improving application security processes, standards, and governance across the organization.

Required Qualifications

• Bachelor's degree in Computer Science, Information Technology, or a related technical discipline.
• 8+ years of experience in Application Security or Secure SDLC.
• Strong hands-on experience with :
• Manual Secure Code Review
• Static Application Security Testing (SAST)
• Software Composition Analysis (SCA)
• Ability to read and understand source code written in programming languages such as Java, .NET (C#), Go, Python, or similar languages.

Strong Understanding Of

• OWASP Top 10 (Web, API, and Mobile)
• Secure Coding Practices
• Application Security Testing
• Secure SDLC
• Experience reviewing application architecture from a security perspective.
• Excellent analytical, problem-solving, communication, and stakeholder management skills.
• Self-motivated with the ability to quickly learn new technologies and security tools.

Preferred Qualifications

• Hands-on experience with Checkmarx or similar SAST solutions.
• Security certifications such as CEH, OSCP, CSSLP, CISSP, GWAPT, or equivalent.
• Experience working with enterprise-scale applications and DevSecOps environments.
• Exposure to security frameworks such as PCI-DSS, NIST, or OWASP ASVS will be an added advantage. (ref:hirist.tech)