Secure Coding Sr. Manager
About The Position
Global Information Security (GIS) Security & Solutions Design (SSD) Team is seeking a skilled Application Security Manager with strong experience in secure application development and significant experience with the Checkmarx Static Application Scanning (SAST) tool and the Invicti Dynamic Application Security Testing (DAST) tool. This role manages a team of secure coding / application security engineers and will bridge the gap between development and security, ensuring our applications are built securely and continuously tested for vulnerabilities. This will reduce the risk of introducing critical security weaknesses by identifying gaps prior to technology partners building, changing, or introducing products or solutions to the bank.
Requirements
- Minimum of 5 years of professional pen testing, application security or ethical hacking experience, preferably in a large, complex, enterprise environment
- Detailed technical knowledge in at least 3 of the following areas: security engineering; application architecture; authentication and security protocols; application session management; applied cryptography; common communication protocols; mobile frameworks; single sign-on technologies; exploit automation platforms; RESTful web services
- Experience performing manual code reviews for security relevant issues
- Proven experience in application development (e.g., Java, .NET, Python, JavaScript).
- Significant experience with Checkmarx SAST or similar static scanning tools.
- Significant experience with Invicti DAST or similar dynamic scanning tools.
- Strong understanding of OWASP Top 10 and secure coding principles.
- Hands on experience with CI/CD tools and cloud environments.
- Excellent problem-solving and communication skills.
Nice To Haves
- Security certifications (e.g., CSSLP, GWAPT, OSWE).
- Experience with other AppSec tools (e.g., SCA).
- Knowledge of container security and API security.
Responsibilities
- Integrate and manage SAST scans across development pipelines.
- Integrate and manage DAST scans across development pipelines.
- Analyze scan results, triage vulnerabilities, and collaborate with development teams to adjudicate findings.
- Contribute to secure coding practices and application security standards.
- Support DevSecOps initiatives by embedding security into CI/CD workflows.
- Stay current with emerging threats, vulnerabilities, and security technologies.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Industry
Credit Intermediation and Related Activities
Education Level
No Education Listed
Number of Employees
5,001-10,000 employees
