Application Security Analyst

Where will you end up?

Cipal Schaubroeck develops software for local governments. Citizens and organizations rely on these applications daily, so security is not a detail.

The security team is small and international, making English an important working language as well. Furthermore, you will work closely with the business units, the security champions, and the CISO.

What will you do?

• Secure development: establish coding and security guidelines, support security champions through tooling, and help shape the SSDLC, with a focus on security in CI/CD (Jenkins, GitLab).
• Security testing: integrate SCA (Dependency Track), SAST (SonarQube), DAST (ZAP), and AI-based scanning, supplemented by security-oriented code reviews and threat modelling.
• Security framework: bring the guidelines from the control and security framework to the teams, perform assessments, and support teams with CRA compliance.
• Vulnerabilities and incidents: prioritize vulnerabilities via risk analysis, CVSS, and EPSS. In the event of a hack or vulnerability, determine the impact, bring the right people together, and take charge of the follow-up and RCA.
• Advice: provide substantiated advice to the CISO and proactively approach teams across the entire organization.

Who are you?

An experienced profile with a solid development background and a great interest in application security.

• Background: bachelor's degree level, at least 5 years of experience in development or applications, good Java knowledge, insight into how systems interconnect, and affinity with the role of security champion.
• Knowledge: SSDLC and OWASP SAMM, OWASP Top 10 and ASVS, vulnerability management and incident response (CVSS, EPSS), Dependency Track, SonarQube, and ZAP in CI/CD, container security and hardening, secure design patterns, and basic knowledge of GDPR and CRA (no legal knowledge required).
• Personality: leadership and ownership during incidents, proactive, critical, and steadfast, even towards a CISO.
• Language: Dutch & English.

Plus points

Experience with threat modelling according to STRIDE, knowledge of AI-security (protecting AI systems), and certifications in (application) security or AI.

Why work at Cipal Schaubroeck?

Are you looking for a pleasant working environment where team spirit and innovation are central? Then Cipal Schaubroeck is the ideal place for you!

• Attractive compensation package: Including an electric car, extensive insurance package, meal vouchers, home office allowance, and more.
• Work-Life Balance: We offer standard hybrid working, so you can maintain a healthy balance between work and private life.
• Training opportunities: Continue to develop with our TSS Academies and numerous other learning opportunities.
• Personal growth: We believe that everyone is the architect of their own career and support your professional ambitions.
• Room for innovation: You will get the chance to think along about new technologies, including AI, and how we can deploy them in a meaningful way within our services.

Do you want to help determine how secure the software is that our local governments and citizens rely on daily? Apply now.