Senior Application Security Expert

Details

We are looking for a Senior Application Security Expert to strengthen secure software development practices. You will perform design reviews, code reviews, application security assessments, and help development teams integrate security into every stage of the software development lifecycle.

Working closely with engineering, architecture, cloud, and DevSecOps teams, you will drive the adoption of security testing tools such as SAST, DAST, and SCA while promoting secure coding practices and security-by-design principles. You will conduct threat modelling, cloud application and code security reviews, and advise development teams on information security.

Responsibilities

• Embed security into the design, development, and operation of the banking platform.
• Conduct design reviews, code reviews, application security assessments, threat modelling, security architecture reviews, and risk assessments.
• Assess applications, APIs, cloud workloads, and platform services.
• Help development, architecture, cloud, and DevSecOps teams integrate security into the software development lifecycle.
• Promote secure coding practices and security-by-design principles.
• Drive the adoption of SAST, DAST, and SCA security testing tools.
• Provide cloud security advice and support secure CI/CD practices.
• Advise and collaborate with development teams and stakeholders.
• Document findings, write reports, and present security results to technical and non-technical stakeholders.

Working Environment

You will join the CISO T&E Application Security team within the Corporate Information Security Office. The team is responsible for information security globally across the bank's subsidiaries and countries. The T&E department ensures that secure-by-design principles are applied at multiple layers, including applications and infrastructure, and acts as the primary interface for departments enabling CI/CD practices in the bank. The team consists of 20 members of different nationalities, and English is the working language.

The office in Amsterdam Southeast is the home base for this role.

Requirements

• Passion for your field of expertise.
• At least 8 years of experience in IT, including a minimum of 6 years in information security, application security, or secure software development.
• Strong understanding of common application security risks and frameworks, including the OWASP Top 10, secure coding practices, SAST, DAST, and security-by-design principles.
• Proven experience conducting threat modelling, security architecture reviews, and risk assessments for applications, APIs, cloud workloads, and platform services.
• Knowledge of access control, cryptography, container security, secure configuration management, vulnerability management, and platform hardening.
• Microsoft Azure expertise is preferred.
• Experience in security consulting, documentation, report writing, and presenting security findings to technical and non-technical stakeholders.
• Hands-on, self-organized, service-oriented, and able to work as a team player.
• Ability to manage stakeholders and work effectively in an internal consultancy role.

Benefits

• Gross monthly salary of €7,048–€10,068 based on a 36-hour work week, including holiday allowance and a flexible benefit budget.
• Excellent pension scheme.
• Flexible working, with working from home possible in consultation with the team and depending on the role.
• Ergonomic home office setup.
• Five weeks of vacation per year, supplemented by two mandatory days off.
• Option to purchase up to four additional weeks of vacation annually.
• Five additional “Banking for better days” for personal development or volunteer work.
• Development budget of €1,000 per year, accumulable up to €3,000.
• Annual public transport pass providing free public transportation throughout the Netherlands for business and private use.
• Employment conditions governed by the applicable Collective Labour Agreement.