DevSecOps application security engineer in banking

About the project: We are looking for a DevSecOps / AppSec Engineer to join an international project in the banking sector. This initiative is at the core of our software security strategy and is responsible for managing vulnerabilities across all development and deployment pipelines. If you are passionate about the shift-left approach, automating security controls in CI/CD environments, and working directly with development teams to build secure software from the outset, this is the project for you.

• Pipeline Security: Implement, automate, and maintain vulnerability detection tools (SAST, DAST, SCA) such as SonarQube, Checkmarx, and OWASP ZAP within CI/CD workflows.
• Triage and Remediation: Monitor, analyze, and prioritize vulnerabilities detected in third-party libraries, dependencies, and frameworks (npm, Maven, pip, Go modules).
• Automation: Develop scripts (Python, Bash) to automate dependency updates and security workflows.
• Container Security: Secure deployments in orchestrated environments, working closely with OpenShift and Docker.
• Reporting and Best Practices: Define secure coding guidelines, record compliance evidence in Jira, and report risk status and metrics to stakeholders and security management.
• Incident Response: Provide technical support for critical vulnerabilities (zero-day exploits, high-severity CVEs).

• Around 3–4 years of professional experience in IT, with at least 2 years of direct experience in Application Security, DevSecOps, or software-level Vulnerability Management.
• Hands-on experience integrating SAST, DAST, and SCA tools into the software development lifecycle.
• Strong scripting skills (Python, Bash) applied to automation in CI/CD pipelines.
• Knowledge and experience with container environments and their security (Docker, OpenShift/Kubernetes).
• Command of the threat landscape (OWASP Top 10, CWE) and vulnerability scoring methodology (CVSS).
• Fluent use of version control (Git/GitHub) and incident management (Jira).
• Ability to communicate fluently in English or French (proficiency in either one is sufficient).
• Будет плюсом: Knowledge of security in Cloud environments (AWS, Azure, or GCP); Experience with corporate vulnerability management platforms (Tenable, Qualys, Rapid7) and regulatory standards (ISO 27001, SOC 2); Industry certifications such as OSCP, CISSP, CEH, or CCSP

• Join a banking-sector project in a mature, high-impact technology environment within a global leader.
• Flexibility to work from Spain or France (remote/hybrid).