Senior Application Security Expert

At a glance

We are looking for a Senior Application Security Expert to strengthen our secure software development practices. You will perform design reviews, code reviews, application security assessments, and help development teams integrate security into every stage of the SDLC.

Working closely with engineering, architecture, and DevOps teams, you will drive adoption of security testing tools such as SAST, DAST, and SCA while promoting secure coding practices and security-by-design principles. You brainstorm, advise and work together with our talented development teams to secure information security at the start of our banking products by doing threat modelling, cloud application and code security reviews. Briefly: a constant co-creation and security by design!

Your job

As a Senior Application Security Expert, you will be responsible for embedding security into the design, development, and operation of our banking platform. Working closely with development, architecture, cloud, and DevSecOps teams, you will help ensure that security is built in from the start and remains an integral part of the software development lifecycle. The role combines hands-on application security expertise with cloud security advisory and stakeholder engagement responsibilities.

Working environment

You will join the CISO T&E Application Security team, part of the Corporate Information Security Office (CISO) department. CISO is responsible for the bank's information security globally, across all subsidiaries and countries. T&E department is responsible in ensuring secure by design principles are applied at multiple layers such as Application, Infrastruture. We also act as primary interface to departments enabling CI/CD practices in the bank.

The T&E Application Security team currently consists of 20 members with different nationalities. The working language within the team is English speaking.

Your profile

You're a hands-on, self-organized teamplayer who's willing to finish and deliver. You describe yourself as a service oriented professional, you enjoy taking on an internal consultancy role and are able to manage stakeholders naturally. Furthermore you recognize yourself in the following:

• At least 8 years of experience in IT, including a minimum of 6 years in Information Security, Application Security, or Secure Software Development.
• Strong understanding of common application security risks and frameworks, including the OWASP Top 10, secure coding practices, SAST and DAST, and security-by-design principles.
• Proven experience conducting threat modelling, security architecture reviews, and risk assessments for applications, APIs, cloud workloads, and platform services.
• Knowledge of security technologies and domains such as access control, cryptography, container security, secure configuration management, vulnerability management, and platform hardening, preferably with Microsoft Azure expertise.
• Experience in security consulting, documentation, report writing, and presenting security findings to technical and non-technical stakeholders.

We are offering

Joining us means stepping into a role with impact, supported by employment conditions that foster your job satisfaction, development, and wellbeing. In addition, we offer:

• An excellent pension scheme, ensuring that you are well prepared for the future.
• Flexibility in working: working from home is possible in consultation with your team and depending on your role. We will provide an ergonomic home office setup for you.
• Plenty of room for relaxation with five weeks of vacation per year, supplemented by two mandatory days off. You can also purchase up to four additional weeks of vacation annually.
• Five “Banking for better days”: extra days off that you can use for personal development or volunteer work.
• Personal development is key: you receive a development budget of €1,000 per year, which can accumulate up to €3,000.
• An annual public transport pass with free public transportation throughout the Netherlands for both business and private use.