Expert Lead Application Security

Keystone Solutions is seeking an Expert Lead in Application Security to join our consultancy mission at a client site. The client manages a portfolio of approximately 800 applications, including nearly 400 web applications, utilizing various technologies and providers. The role is crucial in mitigating risks associated with application lifecycle management, ensuring compliance with security requirements, and enhancing the overall security posture.

• →Act as a reference for application security expertise regarding risks, project support, technical aspects, and DevSecOps.
• →Manage risk and requirement aspects of the Secure Application Lifecycle Management (SALM) projects, ensuring alignment of controls with application criticality and decision traceability.
• →Oversee technical controls within SALM projects and integrate them into development practices, utilizing results from tools to qualify vulnerabilities and support their remediation.
• →Lead SALM thematic activities, monitor operational activities, adherence to methods and deadlines, and report on progress through tracking tables and evolution plans.
• →Collaborate with project managers, developers, architects, and operational teams to replace manual controls with a common, risk-proportional, and automated approach covering the entire application lifecycle.

• Leadership: Frame, support, and empower the team.
• Responsibility: Take charge of missions and report on progress.
• Technical Credibility: Handle complex cases and substantiate decisions.
• Prioritization: Make decisions based on risks and capacity.
• Exigency and Kindness: Ensure quality and foster team development.
• Pragmatism: Propose applicable measures.
• Communication: Tailor messages to different audiences.
• Autonomy and Synthesis: Monitor commitments and report on decisions.

• Communication avec projets, IT, métiers, fournisseurs et management
• (mandatory) - Level: T3 - Senior - Most recent: Any time
• DevSecOps : SAST, DAST, SCA, CI/CD, secrets et tests d’intrusion
• (mandatory) - Level: T3 - Senior - Most recent: Any time
• Leadership : charge, priorités, accompagnement et qualité
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Pilotage de backlog selon le risque et la criticité
• (mandatory) - Level: T3 - Senior - Most recent: Any time
• Processus, standards, modèles, indicateurs et transfert de compétences
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Référentiels : OWASP, ISO 27001/27005, NIST SSDF, NIS2, CyFun, ANSSI
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Sécurité applicative et SSDLC : risques, exigences, revues et vulnérabilités
• (mandatory) - Level: T3 - Senior - Most recent: This year

French
(mandatory)
Level Proficiency (C2)