The Application Security Specialist safeguards the bank’s internally developed and third-party applications by embedding security throughout the software development lifecycle and supporting the timely identification and remediation of vulnerabilities.  The role works closely with development, infrastructure and risk teams to
strengthen application security controls and promote secure development practices.

Through application security assurance, incident response support and alignment with regulatory requirements and internal security standards, the role helps protect sensitive information, reduce cyber risk and maintain reliable banking services, enabling secure digital innovation and sustaining customer trust.

Key Result Areas

Application Security Assessments

• Conduct thorough security testing (SAST, DAST, code reviews) on in-house and third-party applications to identify vulnerabilities.

Vulnerability Management and Remediation Support

• Analyse, prioritize, and track remediation of application security issues in collaboration with development and infrastructure teams.

Secure Development Lifecycle (SDLC) Integration

• Integrate security requirements into SDLC processes, guiding developers on secure coding standards and threat modelling.

Security Tool Management and Optimization

• Implement, manage, and fine-tune security tools like SAST, DAST, SCA, and other vulnerability scanning solutions.

Incident Response and Forensics

• Support investigation and analysis of security incidents involving applications, contributing to root-cause analysis and mitigation strategies.

Compliance and Policy Adherence

• Ensure applications align with regulatory requirements and internal security standards (e.g. PCI DSS, GDPR, OWASP Top 10).

Documentation and Reporting

• Maintain clear, comprehensive security documentation, vulnerability reports, and metrics to communicate application security posture.

Security Awareness and Knowledge Sharing

• Provide training and guidance to development and technical teams to enhance secure development practices and promote security culture.
• Conduct security assessments on internally developed and third- party applications, including code reviews, static and dynamic analysis, and vulnerability scanning.
• Identify, analyze, and report vulnerabilities in applications and work with development and infrastructure teams to ensure timely remediation.
• Review configurations and logs of application servers, web servers, databases, and middleware components for compliance with security policies and standards.
• Oversee the implementation and management of application security tools, such as Static Application Security Testing (SAST), Dynamic
• Application Security Testing (DAST), Software Composition Analysis (SCA), and vulnerability scanners.
• Collaborate with developers to integrate security into the software development lifecycle (SDLC), providing guidance on secure coding practices.
• Develop and maintain security baselines and hardening guidelines for applications and related systems.
• Participate in threat modeling exercises and design reviews for new applications or significant changes to existing systems.
• Review activities of privileged access on application systems and ensure proper user access controls and segregation of duties.
• Investigate security incidents related to applications, conduct root-cause analysis, and contribute to incident response efforts.
• Document application security procedures, standards, and reports, ensuring alignment with regulatory requirements and internal policies.
• Support compliance efforts by ensuring application environments meet standards such as PCI DSS, GDPR, and local banking regulations.
• Track and report metrics related to application vulnerabilities, remediation efforts, and security testing outcomes.
• Participate in training and knowledge sharing to promote secure development practices across the bank’s technology teams.
• Stay updated on emerging threats, vulnerabilities, and security technologies relevant to applications