Application Security Engineer (AppSec) | Min 4 years of experience

Project overview

Missions:

Application Governance, Requirements, and Risk

ASVS, Top 10, CWE, and applicable requirements).

Security Testing and Evaluation

results, dismiss false positives, and produce security reports.

Development Lifecycle Security (DevSecOps)

and the use of maintained dependencies.

Vulnerability Management

treatment of critical vulnerabilities in production.

Awareness and Support

• Define AppSec requirements, standards, and repositories while classifying applications based on their criticality, data, and exposure.
• Participate in architecture reviews and risk analyses to integrate security requirements into projects and go-live criteria (OWASP
• Perform or manage code reviews and security testing of Web applications, APIs, and mobile applications (SAST, DAST, SCA, secrets scanning).
• Identify and qualify vulnerabilities related to authentication, access, input, configurations, cryptography, and components, then analyze the
• Integrate and automate security controls into development processes and CI/CD pipelines, in coordination with DevOps teams.
• Define pre-production security criteria and exemption procedures, while promoting secure development, secrets management, configuration security,
• Centralize, prioritize, and track vulnerabilities based on their severity, exposure, and business impact, then define remediation timelines with stakeholders.
• Monitor fixes and verify their effectiveness, while ensuring traceability of residual risks and exemptions, producing dashboards, and coordinating the
• Support developers, architects, and project managers in fixing vulnerabilities and secure development, while organizing workshops and disseminating best practices.
• Capitalize on recurring incidents and vulnerabilities to improve the Group's security practices.

Project details

• Start: flexible
• Location: Casablanca, Morocco, MA
• Languages: French