DevSecOps Engineer - Application Security
Core
Vulnerability triage and prioritization engineer supporting application security testing tools and the Vulnerability Operations Centre (VOC) across multiple business units.
Role type
Senior DevSecOps Engineer (Application Security)
Builds
Automated triage workflows, vulnerability enrichment pipelines, and risk scoring processes for application security findings.
Domain
Financial Services / Application Security / Vulnerability Management
Required skills
Vulnerability triage, risk-based prioritization, false positive analysis, CVSS/EPSS scoring, exploitability assessment, secure coding guidance, automation scripting, tool integration, technical documentation, stakeholder communication
Preferred skills
Cloud security (AWS/Azure/GCP), SAST/DAST/SCA/container scanning, MITRE ATT&CK, NIST/ISO 27001 frameworks, legacy environment adaptation
Technologies
Python, JavaScript, PowerShell, Bash, SAST, DAST, SCA, container scanners, Confluence/Jira (implied by ticketing), CVSS, EPSS, CWE, CVE, KEV, MITRE ATT&CK
Responsibilities
Triage and analyze vulnerability findings from application security tools; perform false positive analysis and de-duplication; collaborate with developers and BISOs to explain risks; design and implement automation workflows for triage; contribute to security tool selection and integration; provide guidance on secure coding practices; maintain knowledge base documentation and playbooks.
Seniority
Senior, hands-on IC
