Application Security Engineer (DevSecOps)

Job Description:

Our client is recruiting an Application Security Engineer to build security into the software development lifecycle.

You will be a subject-matter expert in application and cloud security, giving assurance, secure design guidance and help with fixing vulnerabilities.

This role would also suit an experienced developer with a keen interest in security.

Essential Skills/Experience:

• Experience securing applications in cloud environments.


• A strong understanding of OWASP Top 10 vulnerabilities.


• Experience with .NET (C#, ASP.NET, APIs).


• Knowledge of Azure CI/CD pipelines.


• Experience with SAST, DAST and software composition analysis tools.


• An understanding of authentication.


• Experience managing and fixing vulnerabilities.


• Strong analytical and communication skills.


• Able to work effectively in agile environments.


• Attention to detail and risk awareness, with the ability to prioritise based on business risk.


• Strong collaboration with engineering teams.


• A proactive approach to continuous improvement.

Core Responsibilities:

• Build security controls into the software development lifecycle.


• Carry out secure design reviews for applications and APIs.


• Run SAST, DAST and software composition analysis, and work with development teams to fix vulnerabilities.


• Integrate security tooling into CI/CD pipelines.


• Define secure coding standards aligned to OWASP best practice.


• Carry out threat modelling for critical systems.


• Make sure cloud configurations are secure.


• Develop detections for application security events and support incident response.


• Maintain the application risk register and vulnerability tracking.


• Give developers guidance and training on secure coding.

Privacy
At Core-Asset, we are committed to protecting and respecting your privacy.

Our Privacy Statement explains when and why we collect personal information about people who engage with our services, the lawful bases we rely on, how we use and share that information, how we keep it secure, and your rights, including how to make a complaint.

You can read it at https://core-asset.co.uk/about/privacy-statement/, and any questions can be sent to our Data Protection Lead, Julie Fraser, at julie@core-asset.co.uk.

We review our Privacy Statement regularly, publish any changes on our website, and will tell you directly about any significant changes.

Terms & Conditions
Our Terms & Conditions explain who we are, the services we provide to candidates and clients, and our respective obligations.

You can review them https://core-asset.co.uk/about/terms-conditions/.

We may update them from time to time, and the current version is always available on our website.

Confidentiality
This email and any attachments are intended solely for the addressee(s) and may be confidential and/or legally privileged.

If you have received it in error, please tell the sender immediately and delete it, and do not disclose, distribute, copy or print it.

Email can be delayed, fail to arrive or be altered without authorisation, and Core-Asset does not accept responsibility for changes made to this email after it was sent.

This email has been prepared using information believed to be reliable, but Core-Asset gives no warranty as to its accuracy or completeness.

We scan emails for viruses but cannot accept responsibility for any damage caused by a virus, or by a third party altering this email, after it was sent.

Monitoring
Emails and instant messages (including attachments) sent to or from Core-Asset may be retained and monitored for security, compliance and record-keeping purposes, in line with our policies and the law, and may be disclosed to law enforcement or regulators where we are required to do so.

Core-Asset Consulting Limited.

Registered in Scotland, company number SC282072.

Registered office: 37 Melville Street, Edinburgh, EH3 7JF.