## Join our Team
About this opportunity
We are looking for a Software Security Master, a senior technical specialist responsible for enabling end-to-end software security across the development lifecycle. You will act as a security subject-matter expert for engineering teams, embedding security by design across architecture, development, testing, CI/CD, release, deployment, and operations. The role combines hands-on security engineering with threat modeling, vulnerability management, DevSecOps, risk management, security testing, and coaching.
What you will do
- Drive security by design throughout the software development lifecycle.
- Conduct security and privacy risk assessments and threat modeling for products and features.
- Identify security risks, attack surfaces, sensitive data, trust boundaries, and required security controls.
- Translate identified risks into security requirements, mitigations, and verification activities.
- Promote secure coding, least privilege, defense in depth, secure authentication and authorization, and data protection practices.
- Perform or coordinate security design reviews, secure code reviews, and root-cause analysis of security issues.
- Integrate automated security controls into CI/CD pipelines, including SAST, DAST, SCA, vulnerability scanning, and secrets detection.
- Analyse CVEs and vulnerabilities affecting applications, platforms, containers, cloud services, operating systems, and third-party dependencies.
- Assess vulnerability severity, exploitability, impact, remediation actions, and target resolution dates.
- Coordinate remediation of critical and high-severity security findings and support risk acceptance where required.
- Plan and review penetration testing, vulnerability assessments, and security verification activities.
- Ensure security risks, test results, remediation actions, and release evidence are properly documented and traceable.
- Provide security guidance for release readiness, deployment, and post-release activities.
- Coach developers, architects, testers, DevOps, SRE, and operations teams on secure development practices.
- Promote security awareness and knowledge sharing across engineering teams.
- Collaborate with product, engineering, architecture, privacy, legal, compliance, operations, and security stakeholders.
Show the full description
The skills you bring
- Bachelor’s or Master’s degree in Computer Science, Software Engineering, Cybersecurity, Information Security, or equivalent experience.
- Strong professional experience in Software Security, Product Security, Application Security, Secure Software Development, or DevSecOps.
- Hands-on experience with threat modeling, security risk assessments, secure coding, code reviews, vulnerability analysis, and security testing.
- Experience analysing CVEs and security findings across applications, operating systems, containers, cloud platforms, and third-party dependencies.
- Strong understanding of vulnerability remediation, mitigation, dependency management, and risk acceptance.
- Experience integrating security controls into CI/CD pipelines.
- Knowledge of SAST, DAST, SCA, vulnerability scanning, secrets detection, and penetration testing.
- Understanding of APIs, distributed systems, IAM, network security, cryptography, and data protection.
- Experience with Kubernetes, containers, Cloud Native technologies, Infrastructure as Code, and security automation is preferred.
- Familiarity with security standards and frameworks such as OWASP, CWE/SANS Top 25, NIST, and ISO 27001.
