About the Position

2022M102_P-098 Expert Lead in Application Security

Location: Belgium

Duration: 12 months

Start Date: 04/01/2027

End Date: 03/01/2028

Responsibilities

The SPW Digital manages a portfolio of approximately 800 applications, including nearly 400 web applications, relying on various technologies and providers. Poor management of their lifecycle can lead to:

Disruption of public services
Compromise of data or application functions
Exploitation of vulnerabilities in code, components, or configurations
Increased technical debt and obsolescence risks
Non-compliance with security requirements, including NIS2, CyFun, and the SPW Information Security Program
Longer and more costly fixes when security is addressed too late

To address these risks, the SPW Digital Security Hub has a dedicated team for Secure Application Lifecycle Management (SALM). Their main tasks include:

Determining the criticality of applications and the security controls to be applied
Conducting risk analyses and monitoring measures according to the methodology in place at SPW
Defining SPW's application security standards and practices
Integrating security controls into projects and DevSecOps/CI/CD chains: SAST, DAST, SCA, vulnerability scans, and intrusion tests
Monitoring exceptions, residual risks, and recommendations before production
Tracking application vulnerabilities, obsolescence, and decommissioning
Advising project, development, architecture, and operations teams

The team works with project managers, developers, architects, operations, functional managers, service centers, DevSecOps and SecOps teams, the SOC, business units, and service providers.

The goal is to replace ad-hoc and manual controls with a common, risk-proportionate, more automated approach covering the entire application lifecycle.

Requirements

Roles

IT Security Expert T3 - Senior

Languages

French Proficiency (C2)

Skills

Leadership: Framing, supporting, and holding the team accountable (T2 - Confirmed)
Frameworks: OWASP, ISO 27001/27005, NIST SSDF, NIS2, CyFun, ANSSI (T2 - Confirmed)
Processes, standards, models, indicators, and skills transfer (T2 - Confirmed)
DevSecOps: SAST, DAST, SCA, CI/CD, secrets, and intrusion tests (T3 - Senior)
Backlog management based on risk and criticality (T3 - Senior)
Communication with projects, IT, business units, suppliers, and management (T3 - Senior)
Application security and SSDLC: Risks, requirements, reviews, and vulnerabilities (T3 - Senior)

Nice to Have

Processes
Standards
Models
Indicators
Skills transfer
Backlog management

We Offer

Competitive salary
Opportunity to work in a dynamic and innovative environment
Professional development opportunities

About the Company

SPW Digital is a leading digital service provider in Belgium, managing a vast portfolio of applications to ensure the security and reliability of public services. Our mission is to protect and enhance the digital infrastructure of the country.

Apply now to join our team and contribute to the security and success of our digital services.

2022M102_P-098 Expert lead sécurité applicative

Job description