Application Security Manager

About easypaisa digital bank:

easypaisa is Pakistan’s first digital bank and has advanced Pakistan’s digital finance landscape. Backed by our shareholders, Telenor Group-a leading telecom operator in Asia and the Nordics- and Ant Group-the force behind Alipay, the world’s leading open internet platform, easypaisa deliver secure, convenient financial solutions to millions of Pakistanis.

POSITION SUMMARY:

Incumbent would be responsible for overseeing the secure deployment of servers, applications, containers and databases, guiding the team in addressing security gaps, and assisting in managing the Information Security Risk Register with a focus on Application Security.

Assisting the Head of Application Security, GRC or CISO in managing the Information Security Risk Register specifically related to Application Security threats and risks. This includes identifying and prioritizing risks, as well as preparing reports and management information system (MIS) on assessments for relevant stakeholders.

DUTIES & RESPONSIBILITIES:

1. Conducting a variety of assessments, including vulnerability assessments and penetration testing, for various types of applications (desktop, web, mobile), APIs, databases, containers, integrations, and servers.
2. Ensuring the security of servers, applications, and databases before they are deployed to the production environment. This includes overseeing vulnerability assessments and penetration testing.
3. Providing guidance to developers and systems administrators on securing the environment and addressing any identified security gaps.
4. Performing vulnerability assessments and penetration testing for cloud-based applications, whether developed in-house or received from third parties, and tracking progress using a smart sheet.
5. Reviewing Business Requirement Documents (BRD) and Product Requirement Documents (PRD), both for in-house change requests and third-party integrations.
6. Participating in Cross Functional Team (CFT) meetings and reviewing the flow of third-party integrations in a phased manner.
7. Conducting static and dynamic analysis, as well as penetration testing, for mobile and web applications to identify any security gaps.
8. Assessing all third-party integrations and APIs according to a defined roadmap and plan.
9. Managing a team to conduct both ad-hoc and planned reviews, ensuring timely closure of security matters.
10. Maintaining a tracker within a smart sheet to keep a record of assessments performed and following up with relevant teams on the status of vulnerability fixes, as well as pushing for prioritization of timelines.
11. Reviewing information security requirements for contract agreements with external business partners.
12. Preparing reports to share with relevant stakeholders, highlighting risks and suggesting mitigation strategies, and following up on the implementation of these strategies.
13. Interacting with developers and system administrators to provide security education, helping them understand information security requirements and addressing findings by offering resolutions.
14. Developing metrics programs for secure development and data loss prevention programs.
15. Participating in the Information Security Awareness Program of the organization.
16. Conducting regular security audits, both from a theoretical and hands-on standpoint, to assess the effectiveness of security measures.
17. Participating in Information Security Risk Assessments and sharing reports.
18. Undertaking any other responsibilities and additional duties assigned by the Head of Information Security or Chief Information Security Officer (CISO).

QUALIFICATION & EXPERIENCE:

• Minimum bachelor’s in computer science (CS/IS or Engineering) from a reputable institute.
• Should have +5 Years of hands-on experience of Server, Application Vulnerability Scanning and Penetration Testing.
• Certifications relevant to Position will be preferred.
• 2-3 years of hands on experience in Application Security, Server, Application Vulnerability Scanning and Penetration Testing.

Understanding of MITRE Attack, OWASP, OSTTM and other security frameworks is an added advantage