Application Security SME

Key Responsibilities

• Conduct Vulnerability Assessments and Penetration Testing (VA/PT) using industry-standard methodologies and tools.
• Perform Threat Modeling and Secure Design Reviews for applications, APIs, cloud-native, and AI-enabled solutions.
• Execute DAST, vulnerability validation, remediation verification, and retesting activities.
• Support DevSecOps initiatives by integrating security controls into CI/CD pipelines.
• Assess application architectures, cloud services, third-party integrations, and emerging technologies.
• Develop risk-based remediation recommendations and security improvement plans.
• Prepare assessment reports, risk assessments, and executive summaries.
• Present findings and recommendations to stakeholders and technical teams.
• Collaborate with development, architecture, infrastructure, and business teams to strengthen the organization's security posture.
• Provide subject matter expertise in application security, secure coding, AI security, and vulnerability management.
• Develop, maintain, and continuously improve Application Security policies, standards, procedures, and testing methodologies to enhance security governance, standardization, and secure development practices across the SDLC and DevSecOps lifecycle.
• Stay current with emerging threats, security trends, and industry best practices.

Qualifications

• Bachelor's Degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
• Minimum of five (5) years of experience in Application Security, Penetration Testing, Vulnerability Assessment, Security Architecture, or related cybersecurity roles.
• Hands-on experience in Web Application and API Security Assessments.
• Strong knowledge of Threat Modeling, Secure Design Reviews, Security Architecture, Secure SDLC, and DevSecOps.
• Solid understanding of OWASP Top 10, OWASP API Security Top 10, and secure coding practices.
• Experience performing manual penetration testing, vulnerability validation, and remediation verification.
• Familiarity with AI/LLM security concepts and assessment methodologies.
• Strong communication, reporting, and stakeholder management skills.

Preferred Skills

• Proficiency in security testing tools including Burp Suite, Qualys, Nessus, Nmap, Metasploit, Kali Linux and similar application security and vulnerability assessment platforms.
• Vulnerability Management and Security Compliance
• Scripting and automation using PowerShell, Python, or Bash
• AI/LLM Security Assessments and Threat Modeling
• Mobile Application Penetration Testing (iOS and Android)
• SAST, DAST, SCA, and Secure Code Review methodologies
• DevSecOps, CI/CD Security, and Security Automation
• Cloud, Container, Kubernetes, and Microservices Security
• Security Architecture Reviews, Red Teaming, or Adversary Simulation Exercises
• Professional certifications such as OSCP, GPEN, GWAPT, CISSP or equivalent Application Security and Penetration Testing certifications are an advantage