Medior Analyste sécurité applicative – orientation technique et DevSecOps

About the Position

Medior Analyste sécurité applicative – orientation technique et DevSecOps

We are seeking a Medior Analyste sécurité applicative with expertise in DevSecOps to join our team in Belgium, focusing on application security and lifecycle management.

Responsibilities

The SPW Digital manages a portfolio of approximately 800 applications, including nearly 400 web applications, relying on various technologies and providers. Poor management of their lifecycle can lead to:

• Disruption of public services
• Compromise of data or application functions
• Exploitation of vulnerabilities in code, components, or configurations
• Increased technical debt and obsolescence risks
• Non-compliance with security requirements, including NIS2, CyFun, and the SPW Information Security Program
• Longer and more costly fixes when security is addressed too late

To address these risks, the SPW Digital Security Division has a dedicated team for Secure Application Lifecycle Management (SALM). Their main tasks include:

• Determining the criticality of applications and the security controls to be applied
• Conducting risk analyses and monitoring measures according to the methodology in place at SPW
• Defining the SPW's application security standards and practices
• Integrating security controls into projects and DevSecOps/CI/CD pipelines: SAST, DAST, SCA, vulnerability scans, and penetration testing
• Monitoring exceptions, residual risks, and recommendations before production
• Tracking vulnerabilities, obsolescence, and decommissioning of applications
• Advising project, development, architecture, and operations teams

The team works with project managers, developers, architects, operations, functional managers, service centers, DevSecOps and SecOps teams, the SOC, business units, and providers.

The goal is to replace ad-hoc and manual controls with a common, risk-proportionate, more automated approach covering the entire application lifecycle.

Requirements

Roles

• IT Security Analyst T2 - Confirmed

Languages

• French Proficiency (C2)

Skills

• Application security tools: SAST, DAST, SCA, secrets detection, and vulnerability scans T2 - Confirmed
• Technical references: OWASP Top 10, ASVS, SAMM, CWE, CVSS, and NIST SSDF T1 - Junior
• Application architecture and security: flows, authentication, authorization, encryption, API, and dependencies T2 - Confirmed
• Vulnerability analysis and qualification: exploitability, impact, false positives, and prioritization T2 - Confirmed
• Development security, API, software dependencies, containers, and secrets management T1 - Junior
• Technical reporting, documentation, and support for development teams T2 - Confirmed
• CI/CD pipelines and DevSecOps practices: integration, configuration, automation, and quality gates T2 - Confirmed

We Offer

(No specific benefits mentioned in the original text)

About the Company

The SPW Digital manages a portfolio of approximately 800 applications, including nearly 400 web applications, relying on various technologies and providers.