Application Security Architect

Full Time London London IT Job Pro UK

Gerrard White is seeking an Application Security Architect for a global advertising and marketing media company to be based from their London office with opportunities for some home working.

The Application Security Architect will be responsible for reviewing applications to secure the organization's critical IT assets according to appropriate security practices and in compliance with standards, policies, procedures and security architecture.

Key duties will be the assessment of the security of applications – commercial products and inhouse developed – throughout their lifecycle, at the stages of requirements gathering, design, build, procurement and update, to ensure compliance, while enabling the business to meet the requirements of the information security technology architecture, strategy and baseline.

Key tasks:

Assist Security Engineering & Architecture function to perform application and data security reviews to confirm that applications are compliant with policies, standards and security architecture, and that the right security controls are applied to keep data secure.
Assist the Security Engineering & Architecture function, Enterprise Architecture function to apply security controls such as multi-factor authentication, security information event management, database encryption, database monitoring and web application firewall to applications.
Research new security technologies and their application to the corporate environment.
Collaborate with project teams in research and design phases of solutions to ensure that information security is a fundamental quality.
Design implement and support application security solutions in compliance with security-related standards, policies and procedures, and security architecture,
Suitable candidates will have:

Strong experience of reviewing the security of applications for alignment with security architecture, security policy, security standards and best practices.
Experience of reviewing and contributing to corporate security architecture frameworks, security standards and security policies.
Experience of web server, web application and API security and remediation. In-depth knowledge of OWASP Top-10 security risks and how to address them.
Experience of application risk assessment via threat modelling using STRIDE, OCTAVE, PASTA or similar framework, and of providing recommendations to mitigate threats and reduce risk.
Experience of using web dynamic application security testing (DAST) tools such as Burp Suite, OWASP ZAP and Checkmarx, and of providing recommendations to mitigate vulnerabilities.
Experience of using network security assessment tools such as NMAP and Nessus and of providing recommendations to address security weaknesses identified.
Experience or working knowledge of penetration testing methods, of interpretation of penetration test reports, and of recommendations to address findings.
Experience of data security solutions such as encryption, hashing, digital signatures, data tokenization and masking.
Working knowledge of multi-factor authentication and single sign-on mechanisms for applications.
Working knowledge of Amazon Web Services and Microsoft Azure cloud computing platforms.
Good general knowledge of core security networking concepts like TLS, SSH, DNS, firewalls, etc.
Good general knowledge of enterprise software, containers, operating systems and server virtualization.
Experience of conducting product evaluations, proofs of concept, pilots and rollouts.
Excellent written and verbal communications skills.
Working knowledge of compliance frameworks and security management standards (e.g., ISO 27001, COBIT, NIST CSF, PCI-DSS, ).
CISSP, CASE, CASS, CLSSP, GIAC GWEB similar certification required.
Solid progressive experience working in Information Technology with at least some of that directly in Information Security.
Some experience in a security architect role with experience in reviewing and approving the security of applications

To apply for this job please visit