Manager - AppSec/DevSecOps Security Engineer

Leadership & Programme Management

• Own and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements.

• Lead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development.

• Act as the primary escalation point for application security risk decisions across engineering and product leadership.

• Drive continuous improvement in AppSec tooling, methodologies, and coverage metrics.

• Represent the AppSec function in client discussions, audits, risk committees, and vendor assessments.

Web Application Penetration Testing

• Oversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios.

• Define and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements.

• Review and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders.

• Drive responsible disclosure and coordinated vulnerability management for critical findings.

Mobile Application Security

• Lead mobile security assessments for Android and iOS—static/dynamic analysis, reverse engineering, and runtime manipulation (Frida, objection, Drozer).

• Establish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams.

• Guide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security.

Source Code Review

• Conduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others).

• Define code review standards and integrate SAST tooling (Semgrep, Checkmarx, Veracode, SonarQube) into development workflows.

• Provide actionable, developer-centric findings with clear severity ratings and remediation guidance.

• Track remediation SLAs and report on code security posture trends over time.

DevSecOps Integration

• Lead integration of security tooling (SAST, DAST, SCA, container scanning, API security) into CI/CD pipelines (Jenkins, GitHub Actions, and similar).

• Define pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left.

• Oversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls.

• Collaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection.

Governance, Risk & Compliance

• Own the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership.

• Ensure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2.

• Define and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates.

• Translate regulatory and client security requirements into testable engineering controls.

AI / GenAI Security

• Assess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows (OWASP LLM Top 10, prompt injection, data leakage).

Incorporate AI security testing into standard AppSec assessment methodologies.