Application Security Manager, Belfast
- Recruiter
- PWC-1
- Location
- Belfast
- Salary
- Competitive
- Posted
- 27 Apr 2018
- Closes
- 25 May 2018
- Sectors
- Facilities Management
- Contract Type
- Permanent
- Hours
- Full Time
Mandated at the network level, Network Information Security (NIS) operates outside Information Technology (IT) and is responsible for this major program initiative, from definition of the security strategy to execution of the global Cyber Readiness Program, moving from local to centralized services.
Our mission is to identify, control and reduce the attack surface across the member firm network while increasing our adversaries' cost of attack.
In order to deliver the Cyber Readiness Program the NIS team is structured into the following Pillars:
Information Security Risk and Compliance (ISRC)
Chief Information Security Office (CISO)
Security Architecture, Engineering, Innovation and Transformation (SAEIT)
Cyber Security Services
Strategy and Alliances
Chief of Staff
If you are seeking an exciting career with the scope to grow your security skills through major change on a global scale, then NIS will empower you to do so.
The SAEIT pillar within NIS is responsible for the following services:
Security Architecture
Security Engineering
Innovation
Security Transformation
Application Security
Definition of application landscape and creation of application risk register across the PwC Network of firms;
Utilisation of application security tools for scanning applications for common application security risks;
Engagement with development teams to articulate complex application security risks;
Continual engagement throughout the software development lifecycle (SDLC) to identify, track and reduce application security risks across new applications;
Assessment of application security vulnerabilities across existing application landscape;
Plan and prioritise application security vulnerabilities and develop structured remediation plan; and
Engaging stakeholders in ISRC to ensure technical vulnerabilities that cannot be remediated are managed and mitigating controls are developed to reduce the risk of said vulnerability within the business environment.
Experience engaging business and technology stakeholders at all levels to gather long term goals and requirements;
Experience mapping long term business requirements to security architecture frameworks such as The Open Group Architecture Framework (TOGAF), Sherwood Applied Business Security Architecture (SABSA), Zachman etc.;
Understanding of how to design and build security technology solutions aligned to a global central service environment;
Understanding of security technology at an enterprise and solution level;
Hands on engineering experience with enterprise security technology;
Experience contributing to a central technology service organization;
Navigating a matrix organization; and
Experience collaborating with multiple stakeholders across functional and technical skill sets.
A 3E Level employee possesses deep knowledge in a specific subject matter area or technical domain related to Application Security that is applied in the context of a broader understanding of Application Security and related systems and processes.
The candidate will contribute to the development of new subject matter/technical domain expertise related to Application Security.
A 3E resolves multi-faceted problems by continuously applying significant independent judgment and by collaborating with others, and influences others through a small team of direct reports, through work on projects and in teams, and/or through leading portions of larger projects.
Demonstrates extensive-level abilities within Application Security.
Encourages improvement and innovation within Application Security and nurturing and developing less-experienced staff through coaching and written/verbal feedback.
Perform Application Security tasks with autonomy.
Through expert knowledge of software development work with development teams to minimize vulnerabilities throughout the Software Development Lifecycle (SDLC)
Through engagement with development teams educate developers around secure coding practices and common vulnerabilities in applications (OWASP Top 10)
Carry out penetration tests on applications to highlight vulnerabilities in the code
Manage reduction of vulnerabilities throughout SDLC
Identify and understand all vulnerabilities across the PwC application landscape
Promote secure coding principles throughout software development teams
Determine critical risks to PwC applications and work with IRSC to create mitigating controls to reduce risks in the live environment to an acceptable level
Location
Belfast
Internal firm services
In order to deliver a first-class service to our clients, we need first-class support internally. Internal firm services is a network of specialist support professionals and includes marketing, recruitment, human capital, finance, technology, learning and development, procurement, to name but a few. Each team plays a vital role in making sure we have all the right resources, services and technology across our business.
The skills we look for in future employees
All our people need to demonstrate the skills and behaviours that support us in delivering our business strategy. This is important to the work we do for our business, and our clients. These skills and behaviours make up our global leadership framework, 'The PwC Professional' and are made up of five core attributes; whole leadership, technical capabilities, business acumen, global acumen and relationships.
Learn more here
Diversity
We work in a changing world which offers great opportunities for people with diverse backgrounds and experiences. We seek to attract and employ the best people from the widest talent pool, as well as those who reflect the diverse nature of our society. And we aim to encourage a culture where people can be themselves and be valued for their strengths. Creating value through diversity is what makes us strong as a business and as an organisation with an increasingly agile workforce, we're open to flexible working arrangements where appropriate.
Learn more here