Senior Applications Security Specialist_Porto

JOB PURPOSE:

The Senior Application Security Specialist supports the security of business applications, platforms, and software solutions throughout their lifecycle. The role performs application security assessments, identifies security risks and vulnerabilities, supports remediation activities, and helps ensure security requirements are effectively implemented across applications and their supporting technology environments.

A key aspect of the role is to act as a technical security bridge between Application teams and other IT functions, including Infrastructure, Cloud, DevOps, Identity & Access Management, SOC, and Enterprise Architecture. The role helps ensure that application security is addressed end to end, covering not only the application itself but also the underlying infrastructure, cloud services, operating systems, databases, APIs, identities, networks, containers, and CI/CD pipelines on which applications depend.

The position works across technical teams to identify security gaps spanning multiple technology domains, clarify technical dependencies and ownership, coordinate remediation activities, and support the implementation of end-to-end security controls for enterprise applications.

RESPONSABILITIES:

Application Security Governance:

• Establish and monitor application security controls across enterprise systems.
• Drive secure-by-design principles throughout the application lifecycle.
• Conduct application security risk assessments.
• Identify, evaluate, and prioritize vulnerabilities and remediation actions.
• Collaborate with application owners and developers to mitigate security risks.

Secure Development & DevSecOps:

• Promote secure development practices and SSDLC requirements.
• Support security integration into CI/CD pipelines and DevOps processes.
• Perform or coordinate SAST, DAST, SCA, penetration testing, API security testing, and container security.
• Support remediation of code vulnerabilities and vulnerable third-party components.

Cross-Functional Security Integration:

• Act as the security bridge between Applications, Infrastructure, Cloud, DevOps, IAM, SOC, Network, and Architecture teams.
• Assess application security end to end, including infrastructure, cloud, databases, APIs, identities, networks, and other dependencies.
• Coordinate remediation of security issues spanning multiple IT teams and technology layers.
• Support consistent security controls across on-premises, cloud, SaaS, and hybrid environments.

Security Advisory & Collaboration:

• Provide practical security guidance to application, development, infrastructure, cloud, and DevOps teams.
• Support projects, upgrades, migrations, and technology initiatives with security expertise.
• Translate security risks and requirements into clear, actionable technical controls across IT teams.

REQUIREMENTS:

• 8+ years of relevant IT experience, preferably within cybersecurity, application security, infrastructure, or DevOps.
• Experience with enterprise applications, cloud platforms, and software development environments.
• Experience conducting security assessments, vulnerability management, and remediation activities.
• Experience working in regulated or multinational environments.
• Fluent in English and Portuguese, both written and spoken.

Technical Skills:

• Experience in application Security.
• Understanding in Secure Software Development Lifecycle (SSDLC).
• Understanding in OWASP Top 10 and Secure Coding Principles.
• Experience in Vulnerability Management.
• Experience in Azure Cloud environment and Cloud Security.
• Experience in DevSecOps practices.

We kindly ask you to submit your CV in English.