{"id":62577,"url":"https://alion.io/job/atkinsrealis-application-security-lead","title":"Application Security Lead","company":{"id":8926,"name":"AtkinsRéalis","domain":"atkinsrealis.com","url":"https://alion.io/company/atkinsrealis","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":78,"open_postings":376,"ghost_share":0,"stale_share":0.864,"repost_share":0.005,"time_to_fill_p50_days":28,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":26000,"max_usd":65000,"period":"year","method":"role_seniority_country_cell","sample_n":13},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure DevOps","optional":false},{"name":"CI/CD","optional":false},{"name":"CVE","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP SAMM","optional":false},{"name":"SBOM","optional":false},{"name":"Azure","optional":true}],"status":"live","first_seen_at":"2026-08-18T00:00:00Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-18T05:37:00Z","board_verified":true,"closed_at":null,"days_open":61,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":61},"description":"Job Description\nOverview\nThe Global Application Security & DevSecOps Lead is responsible for, operating and continuously improving the organisation’s application security function across the complete software development lifecycle.\nThe role owns the policies, technical standards, engineering controls, security testing services, Azure DevOps integrations, application security platforms and governance processes required to ensure that internally developed and externally supplied applications are designed, built, tested and released securely.\nThis is both a leadership and hands-on engineering role. The role holder must be capable of defining the global AppSec strategy while also configuring, integrating, operating, troubleshooting and improving the underlying security tools.\nThe role will embed automated and risk-based security controls into Azure DevOps repositories and CI/CD pipelines at enterprise scale, covering potentially hundreds of Azure DevOps projects and thousands of repositories.\nThe role is accountable for ensuring that security controls are:\nTechnically effective. \nIntegrated into engineering workflows. \nProportionate to application risk. \nReliable enough to support mandatory release gates. \nProperly tuned to minimise false positives. \nMeasurable and auditable. \nSupported by clear operating procedures. \nAdopted consistently across global development teams. \nYour role\nAppSec strategy and operating model\nThe role holder will:\nMaintain the global Application Security and DevSecOps strategy. \nEstablish the AppSec function’s mandate, service catalogue, governance model and engagement process. \nDefine the division of responsibilities between AppSec, engineering, cloud security, architecture, SOC, vulnerability management, risk and compliance. \nDevelop a risk-based AppSec control framework for different application types and criticality levels. \nEstablish minimum security requirements for internally developed, externally developed and SaaS applications. \nDefine application risk tiers based on factors such as:\nData classification. \nInternet exposure. \nTransaction value. \nRegulatory impact. \nPrivileged access. \nCustomer impact. \nBusiness criticality. \nSafety impact. \nUse of AI or autonomous functionality. \nMaintain an AppSec roadmap covering people, process, technology and maturity. \nUndertake periodic maturity assessments against NIST SSDF and OWASP SAMM. \nDevelop annual investment, licensing and resource plans. \nOwn the AppSec tooling budget and supplier roadmap. \nProduce executive-level risk reporting for the CISO and technology leadership. \nRepresent Application Security at architecture, engineering and risk governance forums. \nAppSec service catalogue\nEstablish and operate defined services covering:\nSecure code review. \nSAST onboarding. \nSCA onboarding. \nDAST onboarding. \nAPI security testing. \nMobile security testing. \nPipeline security assessment. \nSecure Azure DevOps configuration. \nSecrets scanning. \nIaC and container scanning. \nPenetration-test scoping and coordination. \nAppSec exception assessment. \nSecure release assurance. \nDeveloper security training. \nSecurity Champions support. \nSupplier application security review. \nApplication incident root-cause analysis. \nSecure SDLC governance\nThe role holder will:\nDefine mandatory security activities for each SDLC stage. \nEstablish security acceptance criteria for epics, features and user stories. \nDefine mandatory evidence required for production release. \nDevelop risk-based security release gates. \nEnsure emergency-release procedures include proportionate security checks and retrospective review. \nDefine criteria for when applications require manual review or penetration testing. \nIntegrate AppSec activities with enterprise architecture and change-management processes. \nAbout you\nThe role owns or governs the following application security capabilities:\nSecure software development lifecycle governance. \nSecure coding standards. \nStatic application security testing. \nSoftware composition analysis. \nDynamic application security testing. \nInteractive application security testing, \nManual secure code review. \nApplication penetration testing. \nAPI security testing. \nCloud-native and serverless application security. \nContainer and application image security during build. \nInfrastructure-as-code security within application delivery pipelines. \nSecrets detection and prevention. \nSoftware supply-chain security. \nSBOM generation and governance. \nBuild provenance, artifact integrity and signing. \nAzure DevOps repository and pipeline security. \nApplication security tool ownership and operation. \nSecurity Champions and developer enablement. \nApplication security exception and risk-acceptance processes. \nApplication security metrics, reporting and assurance. \nThird-party and externally developed software assurance. \nSecurity of AI-enabled applications and AI-generated code. \nProduct security incident support and root-cause analysis. \nExplicit scope boundary: not enterprise vulnerability management\nOperating-system vulnerability scanning. \nGeneral infrastructure vulnerability scanning. \nNetwork-device vulnerability management. \nEndpoint vulnerability management. \nFirmware vulnerability management. \nEnterprise patch management. \nCloud-host vulnerability remediation. \nRuntime host and virtual-machine vulnerability management. \nGeneral CSPM remediation ownership. \nSOC monitoring and incident queue management. \nEnterprise-wide CVE reporting unrelated to applications. \nInfrastructure penetration testing. \nThe AppSec function nevertheless owns the management of security defects, including:\nValidation and triage of AppSec findings. \nRemoval of false positives and duplicate findings. \nAssignment of findings to the correct engineering teams. \nDefinition of application-security remediation requirements. \nVerification that fixes are effective. \nManagement of AppSec-specific exceptions. \nReporting on application-security exposure. \nEscalation of overdue high-risk application findings. \nFor containers, the function owns build-time image and Dockerfile security. Runtime host, node and deployed-container vulnerability management should remain with Cloud Security, Platform Security or Vulnerability Management, subject to a defined RACI.\nRewards & benefits\nExplore the rewards and benefits that help you thrive - at every stage of your life and your career.\nThis includes:\nComprehensive life insurance coverage.\nPremium medical insurance for you and your dependents.\nGenerous annual leave balance.\nFlexible and hybrid work solutions.\nRemote work opportunities outside of country.\nCompany gratuity scheme.\nDiscretionary bonus program.\nRelocation assistance.\nEmployee Wellbeing Program: 24/7 access to specialists in finance, legal matters, family care, personal health, fitness, and nutrition.\nSeize every opportunity to sharpen your skills, expand your expertise, and be recognized for the impact you make.\nAbout AtkinsRéalis\nWe're AtkinsRéalis, a world-class engineering services and nuclear organization. We connect people, data and technology to transform the world's infrastructure and energy systems. Together, with our industry partners and clients, and our global team of consultants, designers, engineers and project managers, we can change the world. We're committed to leading our clients across our various end markets to engineer a better future for our planet and its people.\nFind out more.\nWorker Type\nEmployeeJob Type\nRegularAt AtkinsRéalis, we seek to hire individuals with diverse characteristics, backgrounds and perspectives. We strongly believe that world-class talent makes no distinctions based on gender, ethnic or national origin, sexual identity and orientation, age, religion or disability, but enriches itself through these differences.","description_format":"text","description_chars":7808,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Health insurance","Hybrid work","Insurance coverage","Life insurance","Relocation assistance"],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":true,"industries":["Application Security","Transport Infrastructure","Civil & Structural Engineering","Engineering Services"],"lifecycle":[{"event":"open","at":"2026-08-18T00:00:00Z"},{"event":"close","at":"2026-09-03T11:16:00Z"},{"event":"reopen","at":"2026-10-13T11:12:21Z"}],"visa":[],"liveness":{"score":12,"band":"cold","label":"Long shot","p_open":1,"p_active":0.446,"p_room":0.28,"age_days":60,"expected_fill_days":28,"reasons":["conf:3","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/atkinsrealis-application-security-lead","json_url":"https://alion.io/job/atkinsrealis-application-security-lead.json","meta":{"generated_at":"2026-10-18T07:08:43Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10648,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8926},"rest":"https://alion.io/mcp/rest/get_company?id=8926"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fatkinsrealis-application-security-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fatkinsrealis-application-security-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fatkinsrealis-application-security-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/atkinsrealis-application-security-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fatkinsrealis-application-security-lead"}]}