SRE
Application Security Lead
Tbilisilead
Откликнуться на сайте работодателяОписание вакансии
The Role
You'll own application security across our mobile banking platform, payments stack, and a growing set of regulated products. The work is hands-on, you’ll conduct a threat modeling, security reviews, CI/CD tooling - with real process ownership. You'll report to the Group CISO and work closely with both our engineering teams and the Bank IS function.
Responsibilities
Risk-driven security ownership
- Identify which systems, data flows, and product changes carry the highest real-world risk and build your work around that, not around tool coverage or compliance checklists
- Decide when a security gate is worth slowing down a release and when it isn't, own that call, and be able to explain it to engineering and the CISO
- Maintain a risk register for application-layer exposures: what's open, what's accepted, what's being fixed, and why in that order
Secure SDLC
- Figure out where in our delivery process security decisions are actually being made and put controls there
- Run threat modeling for high-stakes product changes before design is locked, not after
- Build a mobile security testing baseline that the team runs themselves
CI/CD and supply chain
- Assess what the current pipeline actually catches versus what it produces as noise, and fix the ratio before adding more scanners
- Own supply chain posture: dependency pinning, SBOM, internal registry, and the response process when a package gets compromised
- Own secrets detection and remediation end-to-end
Regulatory and cross-team work
- Translate application security gaps into language that satisfies BSP examiners without over-engineering the evidence
- Coordinate security input into new product launches across our Group and Bank structure
Requirements
Experience
- 7+ years in application security, with meaningful ownership over both technical work and process
- Has built or substantially improved a secure SDLC in a fast-moving product org
- Has run threat modeling on real product features and influenced design decisions as a result
- Has owned vulnerability management end-to-end: triage, remediation tracking, SLA management, risk acceptance
- Has done hands-on mobile security testing (iOS and/or Android) in a production context, not just UAT
- Understands modern supply chain attack vectors like compromised packages (npm, PyPI), malicious IDE plugins, typosquatting, dependency confusion - and knows how to reduce exposure at the tooling and process level
- Comfortable writing Python or Bash to automate repetitive security work
Technical Skills
- SAST, DAST, SCA in CI/CD pipelines: knows how to tune for signal, not just coverage
- API security: authentication flows, token handling, common abuse patterns
- Mobile security: OWASP ASVS/MASVS applied in practice
- Supply chain: SBOM generation and dependency risk management
- Secrets management: detection, remediation, and structural prevention
- Working knowledge of AWS and containers sufficient to understand where application risks extend into infrastructure
Nice to have
- Experience in a regulated environment (financial services or similar)
- Familiarity with PCI-DSS, ISO 27001, or BSP MORB
- Certifications: OSCP, GWEB, GWAPT, CSSLP
Communication
- Strong written English; most day-to-day alignment is async
- Can explain a security issue clearly to an engineer and summarize the same issue for a non-technical stakeholder
Это сохранённая копия объявления, опубликованного в другом месте. Вакансии снимают без предупреждения — перед откликом проверьте сайт работодателя. mentors.coach не является нанимающей стороной.