Senior Application Security Specialist

About the role

Old Mutual is looking for an Application Security Lead in its Information and Cybersecurity function in Johannesburg. The role leads the Application Security team and is accountable for building security into the software the business develops, buys and runs, across the secure development lifecycle, code and dependency scanning, application testing, third-party and SaaS applications, application identity and access, and AI features in applications. It is a hands-on lead role.

Key responsibilities

• Ensure software reaches production with known risks found, fixed or formally accepted, and sign off security before release.
• Set application security standards for developers and run the tooling and testing that verifies them.
• Lead the seven service areas: secure development lifecycle (requirements in design, threat modelling), code and dependency scanning (SAST in CI/CD, software composition analysis, secrets scanning), application testing (DAST, API testing, penetration tests), third-party and SaaS applications, identity and access (SSO, MFA, API auth, WAF rules), and AI in applications (prompt injection and data leakage testing).
• Manage two Application Security Analysts, build the bench by cross-skilling them, and partner with delivery leads so security is planned into sprints.
• Manage external penetration testing providers and escalate unremediable risks to the Manager, Information and Cybersecurity.
• Keep the security standard, severity and remediation SLA model, and the exception and risk-acceptance process current, and report application risk to the manager.

Required profile

• National diploma in Computer Science, Information Systems, Engineering or equivalent; demonstrable experience may substitute.
• 5+ years in application security or security testing, including at least 3 years in a dedicated application security role.
• 2+ years leading a team, squad or security workstream, formally or as a technical lead.
• Preferred: financial services or insurance experience, including POPIA, and cloud application security on Azure or AWS.
• Preferred: OSCP, CISSP or equivalent certification.

Required skills

• Hands-on experience with SAST, SCA, DAST and secrets scanning tooling in CI/CD pipelines.
• Working knowledge of OWASP Top 10, OWASP ASVS, API Security Top 10 and SDLC controls under ISO 27001 or NIST CSF.
• Preferred: experience with phishing simulations and training platforms.