Position
Application Security SME
Location
Manila
Experience
6+ years
Required Technical Skill Set
- DevSecOps & API security controls- (Nexus, SonarQube, Trivy) from RHOCP RAC
- Vulnerability Assessment / Penetration Testing - SaaS / Digital Facing Solutions (Cyberint)
Job Description
Serve as the Application Security (AppSec) Subject Matter Expert for the organization's SaaS / Digital Facing Solutions.Lead and execute comprehensive Vulnerability Assessment (VA) and Penetration Testing (PT) across applications and APIs.Manage and administer the Application Security Testing (AST) toolchain, specializing in SonarQube (SAST / Code Quality).Integrate and maintain Trivy for dynamic container image scanning within the CI / CD pipeline for robust security checks.Oversee artifact management security, leveraging Nexus repository for vulnerability scanning and policy enforcement.Provide SME guidance on securing containerized applications deployed on Red Hat OpenShift Container Platform (RHOCP) .Define, implement, and govern the AppSec program using the RACI model for clear accountability across teams.Conduct manual and automated code reviews to identify and prioritize critical security flaws and coding practices.Collaborate with development and DevOps teams to embed security gates throughout the Software Development Lifecycle (SDLC).Develop and standardize secure coding practices, offering targeted training and mentorship to engineering teams.Perform threat modeling and risk analysis for new applications and significant architectural changes.Manage the vulnerability lifecycle from discovery and triage to remediation verification and reporting.Research and analyze emerging application security threats, attack vectors, and exploit techniques.Maintain and tune scanning tools to minimize false positives and ensure accurate reporting on security posture.Track and report on key application security metrics to leadership and risk governance committees.Implement API security controls throughout the API lifecycle from development to retirement.Possess strong knowledge of OWASP Top 10, SANS Top 25, and common industry security standards.Collaborate with teams to define and clarify roles and responsibilities using the RACI matrix for AppSec processes.Lead the remediation effort by providing code-level guidance to developers on mitigating complex security flaws.Manage the bug bounty program and external vendor penetration test engagements.Develop and deliver customized secure coding training for application development teams.Stay current with emerging threats, vulnerabilities, and security technologies to inform risk mitigation strategies.Contribute to the continuous improvement of application security tooling and overall security posture.Certificates
Relevant certifications in DevSecOps and VAPT (Nexus, SonarQube, Trivy)About CLPS RiDiK
RiDiK is a global technology solutions provider and a subsidiary of CLPS Incorporation (NASDAQ : CLPS), delivering cutting‑edge end‑to‑end services across banking, wealth management, and e‑commerce. With deep expertise in AI, cloud, big data, and blockchain, we support clients across Asia, North America, and the Middle East in driving digital transformation and achieving sustainable growth. Operating from regional hubs in 10 countries and backed by a global delivery network, we combine local insight with technical excellence to deliver real, measurable impact. Join RiDiK and be part of an innovative, fast‑growing team shaping the future of technology across industries.
Seniority Level
Mid‑Senior level
Employment Type
Full‑time
Job Function
Information Technology
Industries
IT Services and IT Consulting
#J-18808-Ljbffr