Senior Application Security Specialist

About the role

Old Mutual is looking for an Application Security Lead in its IT GRCS, Information and Cybersecurity function in Johannesburg. The role leads the Application Security team and is accountable for building security into the software the business develops, buys and runs, across the secure development lifecycle, code and dependency scanning, application testing, third-party and SaaS applications, application identity and access, and AI features in applications. It is a hands-on lead role.

Key responsibilities

• Ensure software reaches production with known risks found, fixed or formally accepted, and sign off security before release.
• Set application security standards for developers and run the tooling and testing that verifies them.
• Lead seven service areas through two analysts: secure development lifecycle (requirements in design, threat modelling), code and dependency scanning (SAST, SCA, secrets scanning), application testing (DAST, API testing, penetration tests), third-party and SaaS security, identity and access (SSO, MFA, API auth, WAF), and AI security (prompt injection, data leakage, API key protection).
• Maintain the security standard, severity and remediation SLA model, and the exception and risk-acceptance process, and report application risk to the Manager, Information and Cybersecurity.
• Manage Application Security Analysts, build the bench by cross-skilling them, partner with delivery leads to plan security into sprints, and manage external penetration testing providers.
• Escalate unremediable risks to the Manager with a clear recommendation.

Required profile

• National diploma in Computer Science, Information Systems, Engineering or equivalent; demonstrable experience may substitute.
• 5+ years in application security or security testing, including at least 3 years in a dedicated application security role.
• 2+ years leading a team, squad or security workstream, formally or as a technical lead.
• Preferred: OSCP, CISSP or equivalent; financial services or insurance experience, including POPIA; cloud application security on Azure or AWS.
• Preferred: Bachelor of Commerce (BCom) in Information Technology and Computer Science, Information Technology Management.

Required skills

• Hands-on experience with SAST, SCA, DAST and secrets scanning tooling in CI/CD pipelines.
• Working knowledge of OWASP Top 10, OWASP ASVS, API Security Top 10 and SDLC controls under ISO 27001 or NIST CSF.
• Preferred: experience with phishing simulations and training platforms.