About the Company
Devoteam Cyber Trust is the Cybersecurity specialist arm of the Devoteam Group. With 800+ experts located across EMEA, they aim to establish cybersecurity as an enabler of business success rather than a gatekeeper. They leverage an end-to-end approach to Cyber Resilience, Applied Security, and Managed Security services to secure the tech journey of large and medium-sized companies from all sectors and industries.
Responsibilities
•Define and promote Secure SDLC practices
•Integrate security requirements into the development lifecycle
•Participate in architecture reviews and solution designs
•Conduct threat modeling sessions
•Support teams in implementing authentication, authorization, and data protection mechanisms
•Analyze results originating from Penetration Tests, Vulnerability Assessments, SAST / DAST, Dependency Scanning, Container Scanning
•Classify and prioritize vulnerabilities
•Provide technical support during remediation
•Track remediation plans and their respective SLAs
•Define test scope
•Coordinate with external vendors
•Validate findings
•Ensure tracking and closure of recommendations
•Conduct Secure Coding workshops
•Promote OWASP Top 10 and secure development best practices
•Support the creation of Security Champions within teams
•Produce technical guidelines and standards
•Integrate security controls into CI/CD pipelines
•Promote automation of security checks
•Define application security metrics and key performance indicators (KPIs)
Requirements
•A professional with previous experience in software development and application architecture who has evolved into an Application Security role
•Ability to interact with development, architecture, operations, and corporate security teams, acting simultaneously as a technical consultant, facilitator, and advocate for best practices
•Capacity to understand code, architecture, and development processes, directly supporting the analysis and resolution of identified vulnerabilities
•Solid experience in at least one of the following stacks:
•Java: Spring Boot; REST APIs; Maven
•C# / .NET: .NET Framework / .NET Core; ASP.NET
•Linux, Shell Scripting, and basic system hardening
•Required: Cloud knowledge with hands-on experience in production application deployments
•Practical knowledge of:
•OWASP Top 10, OWASP ASVS, and Secure Coding best practices
•Threat Modeling
•Authentication & Authorization (including OAuth2, OpenID Connect, and JWT)
•API Security & Secure API Design
•Applied Cryptography (TLS, key/certificate lifecycle, secure hashing)
•Secrets Management (secret stores, secret rotation, preventing secrets in code)
•Experience with tools such as: SonarQube, Checkmarx, Fortify, Veracode, Snyk, Dependabot, OWASP ZAP, Burp Suite, or Trivy
•Excellent communication skills
•Ability to influence without hierarchical authority
•Training and mentoring capability
•Pragmatic approach to risk management
•Ability to collaborate easily with development teams
•Strong analytical mindset
Nice to have
•Frontend (Optional / Desirable): Angular (JavaScript / TypeScript)
•Desirable: Knowledge of major cloud platforms (AWS and/or Azure preferred; Google Cloud or others are relevant and transferable)
Conditions
No conditions stated in the posting.
