Secure Coding Domain Expert – Application Security (ID: 4089)

As a Secure Coding Domain Expert, you will: Maintain and improve the organisation’s application security posture by promoting secure software development practices across development teams. Define, maintain, and continuously improve secure coding standards, guidelines, and best practices across different technologies. Analyse, triage, and prioritise security findings generated by Static Application Security Testing (SAST) and Software Composition Analysis (SCA) tools. Work with security tools such as Fortify, Nexus Lifecycle, or similar platforms to identify vulnerabilities, assess risks, and recommend appropriate remediation. Support developers in understanding security findings, investigating root causes, and implementing effective fixes in application code. Improve security tooling by fine-tuning detection rules, reducing false positives, enhancing finding quality, and increasing the effectiveness of security scans. Contribute to internally developed security tools, including repository scanning solutions, and help improve automation within the secure development lifecycle. Research emerging application security risks, including AI-driven attacks and agentic development, while sharing knowledge and helping development teams adopt more secure practices. What You Bring to the Table: 4–6 years of overall professional experience, with relevant experience in secure coding, application security, or software development security. Practical experience in secure coding principles, application vulnerability assessment, and identifying security weaknesses in software. Proficiency in at least one programming language, with the ability to understand application code and support vulnerability remediation. Hands-on experience with SAST and SCA tools such as Fortify, Nexus Lifecycle, or equivalent security analysis platforms. Experience analysing, triaging, prioritising, and explaining security findings based on their severity, impact, and remediation requirements. Understanding of secure software development practices and integration of security checks into DevOps and CI/CD pipelines. Familiarity with Agile ways of working and continuous integration and continuous delivery (CI/CD) practices; Microsoft Azure is a listed competency. Strong communication skills, fluent English, a pragmatic approach to problem-solving, and the ability to work effectively within a large corporate organisation. You Should Possess the Ability to: Interpret SAST and SCA findings, distinguish actionable vulnerabilities from false positives, and recommend appropriate remediation. Explain technical security issues clearly to developers and guide them towards practical, effective fixes. Review application code and assess security risks across different technologies and development environments. Maintain and improve secure coding standards, ensuring that guidelines remain relevant and practical for development teams. Fine-tune security scanning rules and tooling configurations to improve detection accuracy and reduce unnecessary findings. Collaborate with developers, security specialists, and other stakeholders to integrate security into everyday development activities. Investigate emerging security threats, including risks associated with AI-driven attacks and agentic software development. Share security knowledge, influence secure development practices, and balance security requirements with practical delivery needs. What We Bring to the Table: The opportunity to contribute to application security and secure coding initiatives within a large enterprise banking environment. Exposure to security analysis tools, including Fortify, Nexus Lifecycle, and similar SAST/SCA platforms. Opportunities to work closely with software development teams across different technologies and applications. Involvement in improving security tooling, scanning rules, repository analysis, and vulnerability remediation processes. Opportunities to contribute to secure coding standards and strengthen security throughout the software development lifecycle. Exposure to evolving application security challenges, including AI-driven threats and agentic development. A collaborative environment that encourages knowledge sharing, continuous improvement, and pragmatic security solutions. The opportunity to influence secure software development practices and help teams deliver more secure applications. Let’s Connect Want to discuss this opportunity in more detail? Feel free to reach out. Recruiter: Giftson Paul Davidson Phone: +31 20 369 0609 ; Extn : 151 E-mail: giftson.p@stafide.nl LinkedIn: https://www.linkedin.com/in/giftsonpauldavidson/