Application Security Manager (1)
Job Purpose
The Application Security Manager is responsible for leading the Bank’s application security function, and a team of Application security lead, Analyst and engineers ensuring that all business applications, particularly Mission Critical Applications (MCAs) are secure, compliant, and aligned with regulatory and industry standards. The role provides oversight across application security assessments, Secure-Software Development Lifecycle (Secure-SDLC), or Dev-SecOps Identity Lifecyle management, access governance, and secure project delivery, while driving continuous improvement in security posture of the Bank and its customer information. Secondly the Role will give oversight support and guidance to the team of Cybersecurity lead and Cybersecurity Analyst and engineers.
Main Responsibilities
Monitor and analyze security alerts from SIEM, EDR, NDR, SOAR, and other tools to identify suspicious activities and threats.
Lead and manage the Application Security team, ensuring effective delivery of security objectives and initiatives.
Oversee and conduct periodic user access recertification across all bank applications, with focus on MCAs, to enforce least privilege and access governance.
Direct and conduct the execution of Vulnerability Assessments and Penetration Testing (VAPT) for all applications.
Provide security assurance for technology projects, ensuring compliance with security requirements prior to CAB approval.
Define and enforce application security standards, policies, and secure SDLC practices.
Identify, assess, and mitigate application-level risks and vulnerabilities.
Provide ongoing security assurance and reporting on the Bank’s application landscape.
Secure Integration Management: Oversee and ensure secure integration of internal systems such as microservices, API and other third-party services by enforcing security controls, conducting risk assessments, and minimizing potential attack vectors across all interfaces
Advise stakeholders on regulatory and industry frameworks (e.g., OWASP Top 10, NIST, ISO 27001/ISMS, PCI DSS and GDPR).
Daily Responsibilities:
Making regular reports to line manager to issue identified or raised by internal audit, risk and regulatory pertaining to application security unit to line supervisors with clear strategic plan to address them
Coordinated and Conduct user access reviews and recertification activities
Leading the discovery of vulnerabilities and risks in application, software systems and databases and cloud infrastructure with ongoing vulnerability scans, penetration testing and identifying OWASP top 10 threats targeting both bank internal applications and internet facing environments such as digital channels and others on regular basis through intel monitoring and ensuring software applications are updated.
Review and track application security findings, remediation status, and risk exposure
Follow up and enforce the correction of Identified risks via RCSA (Risk Control Self-Assessment)
Educational qualifications and work experience:
Bachelor's level degree BSc. Information Technology / Computer Science / Telecommunications / Engineering (Electrical, Electronic) or related field
Master’s Degree in MBA/MSc
Professional Qualifications Certified Security certification such as: OSWE (Offensive Security Web Expert), OSCP (Offensive Security Certified Professional CISM, ISMS lead Implementeror Lead Audit, GIAC Certifications, CEH
3 years of minimum experience Information Security Management, Governance, Risk Management and Compliance, Security Architecture and Engineering, Security Program Management and Operations, Communication and Network Security, Identity and Access Management, Software Development, Security Assessment and Testing,Information Security Incident Management, IT or Information SecuritySoftware Development, Security Assessment and Testing.
