Application Security Lead

You'll own application security across our mobile banking platform, payments stack, and a growing set of regulated products. The work is hands-on, you’ll conduct a threat modeling, security reviews, CI/CD tooling - with real process ownership. You'll report to the Group CISO and work closely with both our engineering teams and the Bank IS function.

Responsibilities

Risk-driven security ownership

• Identify which systems, data flows, and product changes carry the highest real-world risk and build your work around that, not around tool coverage or compliance checklists
• Decide when a security gate is worth slowing down a release and when it isn't, own that call, and be able to explain it to engineering and the CISO
• Maintain a risk register for application-layer exposures: what's open, what's accepted, what's being fixed, and why in that order

• Figure out where in our delivery process security decisions are actually being made and put controls there
• Run threat modeling for high-stakes product changes before design is locked, not after
• Build a mobile security testing baseline that the team runs themselves

• Assess what the current pipeline actually catches versus what it produces as noise, and fix the ratio before adding more scanners
• Own supply chain posture: dependency pinning, SBOM, internal registry, and the response process when a package gets compromised
• Own secrets detection and remediation end-to-end

• Translate application security gaps into language that satisfies BSP examiners without over-engineering the evidence
• Coordinate security input into new product launches across our Group and Bank structure

Experience

• 7+ years in application security, with meaningful ownership over both technical work and process
• Has built or substantially improved a secure SDLC in a fast-moving product org
• Has run threat modeling on real product features and influenced design decisions as a result
• Has owned vulnerability management end-to-end: triage, remediation tracking, SLA management, risk acceptance
• Has done hands-on mobile security testing (iOS and/or Android) in a production context, not just UAT
• Understands modern supply chain attack vectors like compromised packages (npm, PyPI), malicious IDE plugins, typosquatting, dependency confusion - and knows how to reduce exposure at the tooling and process level
• Comfortable writing Python or Bash to automate repetitive security work

• SAST, DAST, SCA in CI/CD pipelines: knows how to tune for signal, not just coverage
• API security: authentication flows, token handling, common abuse patterns
• Mobile security: OWASP ASVS/MASVS applied in practice
• Supply chain: SBOM generation and dependency risk management
• Secrets management: detection, remediation, and structural prevention
• Working knowledge of AWS and containers sufficient to understand where application risks extend into infrastructure

• Experience in a regulated environment (financial services or similar)
• Familiarity with PCI-DSS, ISO 27001, or BSP MORB
• Certifications: OSCP, GWEB, GWAPT, CSSLP

• Strong written English; most day-to-day alignment is async
• Can explain a security issue clearly to an engineer and summarize the same issue for a non-technical stakeholder