Application Security Engineer at Investec

Description

• The Application Security Engineer is responsible for improving and embedding security throughout the software development lifecycle across Investec's engineering environments. The role focuses on secure software development practices, application security tooling, DevSecOps integration, and engineering enablement to reduce security risk while supporting modern software delivery.
• The role works closely with software engineering teams, platform teams, and security stakeholders to implement scalable application security controls, improve developer security practices, and enhance visibility into software supply chain and application risk.

Key Responsibilities

Application Security Engineering

• Partner with engineering teams to embed security into software design, development, testing, and deployment processes. 
• Provide practical security guidance and support across modern application architectures and development frameworks. 
• Assist teams in identifying and remediating application security vulnerabilities and weaknesses. 
• Promote secure-by-default engineering practices across the software development lifecycle. 

Secure Development and Code Review

• Support secure coding practices across primarily .NET and TypeScript environments, with exposure to Python and Java ecosystems. 
• Review application architectures, code patterns, and integrations for security risks and weaknesses. 
• Assist development teams with remediation guidance and secure implementation approaches. 
• Develop and maintain secure coding standards, patterns, and reusable guidance. 

Application Security Tooling and DevSecOps

• Implement, maintain, and optimise application security tooling across CI/CD pipelines and engineering workflows. 
• Manage and support tooling including: 
• Static Application Security Testing (SAST) 
• Software Composition Analysis (SCA) 
• Secrets detection and scanning 
• Software supply chain security controls 
• Support integration of security tooling into build and deployment processes to enable automated security validation. 
• Work closely with platform and engineering teams to improve developer experience and reduce friction in security adoption. 

Software Supply Chain and Vulnerability Management

• Assist with management and interpretation of software security findings including vulnerabilities, dependency risks, and exposure trends. 
• Maintain familiarity with industry standards and terminology including: 
• CWE (Common Weakness Enumeration) 
• CVE (Common Vulnerabilities and Exposures) 
• SBOM (Software Bill of Materials) 
• Support prioritisation and remediation of application and dependency vulnerabilities. 
• Contribute to improving software supply chain visibility and governance. 

Infrastructure as Code (IaC) and Cloud-Native Security

• Support secure Infrastructure-as-Code practices with a strong focus on Bicep and cloud-native deployment models. 
• Review and improve security controls within application deployment templates and infrastructure definitions. 
• Collaborate with cloud and platform engineering teams to improve secure deployment standards and patterns. 
• Promote DevSecOps practices across application and infrastructure delivery pipelines. 

Security Enablement and Collaboration

• Work closely with developers, architects, and platform teams to improve security maturity across engineering environments. 
• Assist with application security awareness, guidance, and developer enablement initiatives. 
• Contribute to security standards, engineering patterns, and operational processes. 
• Support investigation and response activities related to application security findings and incidents.

Qualifications, Experience and Skills

• Bachelor's degree in Computer Science, Information Technology, Engineering, or related discipline (or equivalent practical experience) 

Relevant Certifications (desirable)

• CSSLP, GWAPT, GWEB, OSWE, or equivalent application security certifications 
• Microsoft Azure certifications advantageous 
• Secure software development or DevSecOps related certifications beneficial

Technical Skills and Experience

• Strong understanding of modern application security principles and secure software development practices. 
• Hands-on experience with .NET and TypeScript application ecosystems. 
• Working knowledge of Python and Java environments advantageous. 
• Familiarity with scripting and automation using PowerShell, Bash, or similar technologies. 
• Experience implementing and managing application security tooling including SAST and SCA solutions. 
• Strong understanding of software supply chain security concepts including SBOMs, dependency management, and vulnerability management. 
• Familiarity with common application security weaknesses and frameworks including OWASP Top 10 and CWE classifications. 
• Experience with CI/CD concepts and DevSecOps integration patterns. 
• Strong Infrastructure-as-Code knowledge with experience in Bicep desirable.

Behavioural Attributes

• Pragmatic and engineering-focused mindset 
• Strong analytical and problem-solving capability 
• Collaborative and developer-friendly approach 
• Ability to communicate complex technical concepts clearly 
• Self-driven with strong ownership and continuous improvement mindset