(1918) Application Security Engineer - BSTD

Brief description

The main purpose of this position is to validate and verify cybersecurity application and software components and identify potential threats and vulnerabilities through testing to support the secure development, implementation and maintenance of business applications within the Business Solutions and Technology Department (BSTD) of the South African Reserve Bank Group (SARB Group).

Detailed description

The successful candidate will be responsible for the following key performance areas:

• Consult stakeholders to understand the expected outputs of applications and software, identify appropriate security controls and achieve an optimal balance between security, functionality and performance.

• Incorporate the identified security controls into technical specifications and documentation to ensure secure deployment, as agreed with stakeholders.

• Develop test plans and design appropriate security software tests to adequately secure applications and software.

• Perform security testing in accordance with agreed and approved test plans, using SARB Group-approved tools, to ensure that security controls meet requirements and align with security standards at each stage of the project development life cycle.

• Collate, document, analyse and report security testing results to identify secure-coding vulnerabilities and application security configuration errors.

• Use vulnerability assessment reports to validate the secure deployment of applications and software within the SARB Group environment, including networks and operating systems.

• Participate in application security audits by providing relevant information and responding to and addressing security-related audit findings, thereby reducing the SARB’s threat landscape and improving its application security posture.

• Keep abreast of cybersecurity technologies, developments and practices.

Job requirements

To be considered for this position, candidates must have:

• a National Diploma (NQF 6) in information technology or an equivalent qualificationin a related field;

• three to five years’ relevant experience in a cybersecurity operations environment, with a focus on designing and implementing manual and automated security software tests and maintaining the relevant technologies; and

• relevant intermediate cybersecurity certifications, such as CompTIA CySA+, Certified Application Security Engineer (CASE) and technology-specific certifications will be advantageous.

Additional requirements include:

• knowledge and skills in:

• industry, organisational and business awareness;

• quality assurance;

• continuous improvement;

• continuous learning and professional development;

• DevSecOps practices and tools for integrating security into CI/CD pipelines;

• the design, development and implementation of security software tests;

• automated testing tools;

• systems and networking;

• application and software testing processes;

• operations; and

• the secure software development life cycle (SSDLC).

In line with the SARB’s commitment to diversifying its workforce, preference will be given to suitable candidates from designated groups. People with disabilities are welcome to apply.

The SARB offers remuneration and benefits commensurate with the level of the position and in line with the market. The level at which the successful applicant will be appointed will depend on his/her competence and experience.