Job Description & Details
This is a heavy-hitting security leadership role inside a major financial institution where you'll act as the bridge between dev teams and the CISO's office. You aren't just writing code or running standard scans; you're driving an enterprise-wide shift toward secure development practices across complex, multi-layered portfolios.
What You'll Actually Be Doing
You'll spend your days wrangling vulnerability management, conducting threat modeling, and embedding security gates directly into the SDLC. Expect to spend a significant amount of time coaching development teams who might view security as a roadblock rather than a feature. You'll be the person translating dense risk frameworks into actionable guidance, managing SAST/DAST/SCA tool integrations in CI/CD pipelines, and reporting the overall security posture up to senior leadership without losing your sanity.
The Core Tech Stack
You need deep expertise in Application Security, Vulnerability Assessment, and Risk Management, backed by a solid foundation in modern Application Development (Java, Python, or .NET). Mastery of DevSecOps toolchains like SonarQube, Veracode, Checkmarx, or Snyk is mandatory because you'll be auditing and enforcing policies across continuous integration pipelines. A strong grasp of cloud platforms, containers, and Kubernetes security will also keep you out of trouble when dealing with modern infrastructure.
Interview Expectations
Expect them to hit you with a scenario where a critical vulnerability is discovered in production right before a major deployment, and the business wants to ship anyway. They want to see how you balance risk mitigation with business velocity and how you influence engineering leads without having direct authority over them. You'll also likely be grilled on your threat modeling methodology and how you would scale application security training across hundreds of developers.
Application Advice
To get past the ATS, your resume needs to explicitly feature keywords like SAST, DAST, SCA, CVSS, and secure SDLC, framed around measurable outcomes in vulnerability remediation. Since this is a banking environment, emphasize any past experience dealing with strict compliance frameworks like PCI-DSS, SOX, or NIST, and highlight your stakeholder management skills rather than just listing technical tools.