Cyber Security Governance

Hands-on Application Security role (non-GRC) within an agile team, requiring strong expertise in software security, secure architecture, threat modeling, and secure development practices. The role focuses on translating requirements into code to create, improve and maintain high-quality software, and on driving application security maturity across the organization.

Responsibilities

Drive the continuous improvement of the organization's application security maturity, defining a structured and scalable approach to secure software development across teams and products; Define, measure, and track key security KPIs related to vulnerability management processes (e.g. detection, remediation, exposure time), providing visibility on risk and progress over time; Lead application security initiatives across the organization, implementing security-by-design principles from the early stages of development; Contribute to the definition and evolution of security controls and practices, maintaining alignment with internal standards, regulatory requirements, and industry frameworks; Collaborate with Product Owners and development teams to align security objectives with business priorities and promote a shared security culture throughout the software development lifecycle; Collaborate closely with engineering teams to define and implement security best practices across the software development lifecycle; Translate requirements into code to create, improve and maintain high-quality software

Requirements

Good knowledge of application security frameworks such as SAMM, ASVS, NIST CSF, and similar; Understanding of certification standards like ISO 27000, as well as NIS2, DORA, ACN guidelines, PCI-DSS, and their impact on application security; Understanding of AI-related risks, key facts, and ecosystem dynamics, paired with strong curiosity and continuous awareness of the current and emerging AI technological landscape; Strong knowledge of application security design principles, such as input filtering, data encryption (in transit and at rest), authentication/authorization frameworks, and secure-by-design best practices; Advanced proficiency in English (C1 level)

Nice to have

Knowledge of AI-focused risk and security frameworks, including NIST AI RMF, EU AI Act requirements, ISO/IEC 23894, OWASP Top 10 for LLMs, and Google SAIF; Prior experience as a software developer or security engineer; Hands-on understanding of the software development lifecycle (SDLC) and ability to read/review code; Familiarity with application security testing methodologies (SAST, DAST, penetration testing, dependency/vulnerability scanning)

Benefits

Wellbeing Digital Wallet from € 3.850 per year (personal budget for travel, medical expenses, parental support, sports, and reimbursements for personal services such as childcare and caregiving); Variable compensation linked to performance; Four-day week; Hybrid work model with autonomy over office attendance; Tailored learning paths and development opportunities within an international group; Inclusive work environment