Lead IT Security - Code Security Engineer

Role & responsibilities

• Within the central division Group Technology (GT) Vulnerability Management & Security Testing (IT1.6.4).
• Perform secure code reviews for web, mobile, and backend applications.
• Identify security vulnerabilities in line with OWASP Top 10, SANS, and CWE standards.
• Analyze and review code written in languages such as Java, JavaScript, Python, C/C++, SQL, ABAP, Swift, or similar.
• Review pull requests and CI/CD pipelines to detect and address security issues.
• Validate and triage SAST findings, including reducing false positives and prioritizing real issues.
• Provide clear, actionable remediation guidance to developers, including secure coding examples.
• Participate in threat modeling and identify design-level security risks.
• Collaborate with development, QA, and release teams throughout the development and release cycles.
• Contribute to the creation and maintenance of secure coding guidelines, standards, and best practices.
• Create and update documentation to support audits, compliance activities, and team training.
• Track identified vulnerabilities through their lifecycle to ensure timely remediation and closure.
• Prepare, document, and share test results and security assessment outcomes with stakeholders.

Key Accountabilities & Responsibilities:

• Manages the functions mailbox end to end, including triaging, prioritising, responding to queries, and escalating complex issues, ensuring clear and timely communication to stakeholders.
• Operates with a high degree of independence and ownership, acting as a trusted extension of leadership in day to day service delivery and stakeholder interactions.
• Functions as a proxy for the service lead for defined areas, representing the function with authority in meetings, communications, and decision making within established parameters.
• Independently drives service operations and coordinates cross functional activities, ensuring continuity of service and issue resolution during the service lead’s absence.
• Supports team success by contributing to continuous improvement.

Key Competencies & Skills required

Technical Skills:

• Knowledge of Secure SDLC (Secure Development Lifecycle) and DevSecOps practices.
• Experience performing secure code reviews and identifying common application security issues.
• Working knowledge of OWASP Top 10 (Web & API) and Common application vulnerabilities and their basic remediation approaches
• Hands-on experience with SAST tools such as Checkmarx, Fortify, and SonarQube.
• Familiarity with core security concepts, including authentication, authorization, cryptography, and session management.
• Ability to read, analyze, and understand existing codebases across multiple technologies.
• Proactive, self-directed, and able to manage assigned workloads while collaborating and cross-training with team members to ensure coverage.

Nice to have:

• Strong written and verbal communication skills, especially for explaining security risks and solutions to technical and non-technical stakeholders.
• Ability to work effectively in fast-paced, agile, and cross-functional team environments.
• Comfortable engaging with stakeholders at various levels, providing remediation guidance, and constructively challenging findings or decisions when necessary.
• Balanced judgment to consider multiple viewpoints while prioritizing security and organizational risk management.
• Patience and willingness to coach development teams on security concepts, helping to improve their secure coding practices over time.
• Proven experience in successfully managing business and partner relationships
• Calmness and clarity of thought under pressure with ability to maintain confidentiality and oversee and handle multiple requests at the same time
• A highly motivated person focusing on personal development, enablement with cultural awareness
• Excellent command of business English

Behavioral Skills:

• Good interpersonal, communication and organizational skills relevant to the role.
• Willingness to learn and quickly adapt to changing requirements.
• Proactive approach to identifying issues and presenting solutions and options
• Ability to direct and guide teams as relevant

Previous Experience & Qualifications

Minimum Educational Qualification:

• Bachelor’s or Master’s degree in Computer Science /Engineering/Information Technology
• Candidate with non-computer science degree must have minimum 7-9 year of relevant experience
• MBA in IT / Insurance/Finance can also apply for Requirements Engineer and Test Engineer role.

Certification if any:

• Certified in one or more relevant industry recognized certification such as CTPRA/CTPRP, CISM, CRISC, CISSP, CGEIT, ITCM, or other relevant industry certification.

Years Experience & Knowledge:

• 7-9 years in Secure Code Review and Application Securi