Senior Analyste sécurité applicative orienté risque

About the Position

Senior Analyste sécurité applicative orienté risque

12 months

04/01/2027 - 03/01/2028
Belgium

---

SPW Digital manages a portfolio of approximately 800 applications, including nearly 400 web applications, relying on various technologies and providers. Poor management of their lifecycle can lead to:

• Disruption of public services
• Compromise of data or application functions
• Exploitation of vulnerabilities in code, components, or configurations
• Increased technical debt and obsolescence risks
• Non-compliance with security requirements, including NIS2, CyFun, and the SPW Information Security Program
• Longer and more costly fixes when security is addressed too late

To address these risks, the SPW Digital Security Hub has a dedicated team for Secure Application Lifecycle Management (SALM). Their main responsibilities include:

• Determining the criticality of applications and the security controls to apply
• Conducting risk analyses and monitoring measures according to the methodology in place at SPW
• Defining SPW's application security standards and practices
• Integrating security controls into projects and DevSecOps/CI/CD pipelines: SAST, DAST, SCA, vulnerability scans, and penetration testing
• Monitoring deviations, residual risks, and recommendations before production
• Tracking application vulnerabilities, obsolescence, and decommissioning
• Advising project, development, architecture, and operations teams

The team works with project managers, developers, architects, operations, functional managers, service centers, DevSecOps and SecOps teams, the SOC, business units, and vendors.

The goal is to replace ad-hoc and manual controls with a common, risk-proportionate, more automated approach covering the entire application lifecycle.

---

Responsibilities

• Risk and Requirement Management: Oversee the risk and requirement aspects of SALM dossiers. Support projects from initial qualification to production, ensuring controls align with application criticality and traceability of decisions.

• Qualification and Criticality: Collect relevant information and qualify the criticality of the application. Determine the SALM process and applicable controls.

• Risks and Threats: Conduct or support risk analyses and threat modeling according to the SPW methodology. Prioritize scenarios, measures, and residual risks.

• Architecture and Requirements: Participate in architecture, design, and flow reviews. Define and verify application security requirements.

• Project Support: Advise project managers, architects, developers, business units, and vendors. Monitor recommendations, deviations, evidence, and decisions.

• Advice and Production: Consolidate the security dossier and prepare the SALM opinion. Report significant trade-offs or risks to the lead.

• Continuous Improvement: Contribute to SALM standards, checklists, models, and lessons learned.

---

Requirements

Core Skills

• Documentation, traceability of decisions, and use of tracking tools or GRC: T1 - Junior
• Communication and dissemination to project managers, architects, developers, business units, and suppliers: T2 - Confirmed
• Application risk analysis, threat scenario identification, and treatment measures definition: T3 - Senior
• Project support: requirements, reviews, deviations, residual risks, and security advice: T3 - Senior
• Threat modeling methods and frameworks: OWASP, STRIDE, ISO 27005, NIST SSDF, NIS2, and CyFun: T2 - Confirmed

Languages

• French: Proficiency (C2)

---

We Offer

• Competitive salary
• Full-time position
• Senior level role
• On-site work location

---

About the Company

SPW Digital is dedicated to managing and securing a vast portfolio of applications to ensure the continuity and integrity of public services. Our mission is to integrate robust security practices throughout the application lifecycle, minimizing risks and ensuring compliance with the highest security standards.