Application Security Specialist

Application Security Specialist at Equity Bank Kenya

Application Security Specialist at Equity Bank Kenya

Job Description – Application Security Specialist

Purpose of the Job

The main responsibility of an Application Security Specialist to ensure the security of EBR applications throughout their development lifecycle. The candidate will work closely with developers, Project Management, and other stakeholders to identify and mitigate vulnerabilities, implement secure coding practices, and enhance overall security posture.

Key Responsibilities:

• Conduct security assessments, penetration testing, and code reviews to identify vulnerabilities in applications.

• Implement secure coding practices and provide guidance to development teams.

• Perform threat modeling and risk analysis to assess application security risks.

• Develop, maintain, and enforce application security policies and standards.

• Collaborate with DevOps teams to integrate security tools into CI/CD pipelines.

• Implement DevSecops policies, processes and procedures and enforce compliance.

• Work with Project Management team to perform security reviews of Projects and Change Requests

• Research and stay up-to-date with emerging security threats, vulnerabilities, and best practices.

• Conduct security training sessions for developers and IT staff.

• Assist in compliance efforts with standards and regulatory requirements (e.g., OWASP, ISO 27001, NIST, BNR, etc.).

• Any other responsibilities that may be delegated by the line manager

Required Qualifications:

• Bachelor’s/Master’s degree in Computer Science, Cybersecurity, or a related field.

• At least 2 years of Experience in application security, penetration testing, or secure software development.

• Security certifications such as CEH, OSWA, OSCP, CSSLP, GWAPT, or relevant certification.

• Strong knowledge of web, mobile, and cloud security principles.

• Familiarity with OWASP Top 10, SANS CWE, and other security frameworks.

• Hands-on experience with SAST, DAST, IAST, and RASP security tools.

• Proficiency in programming languages (e.g., Java, C#,C++, JavaScript).

• Experience with DevSecOps practices and integrating security into CI/CD pipelines.

• Understanding of cryptography, authentication mechanisms, and access controls.

• Experience with cloud security (Azure).

• Knowledge of container security (Docker, Kubernetes).

Core competencies

· Knowledge of SDLC

· Cognizant of relevant application security frameworks

· Secure coding practices

· Knowledge of Threat Modelling

· Ability to communicate findings clearly both in technical and non-technical terms

· Attention to detail