Director, Application Security and Tech&Ops Lead

The Technical Director, Head of Application Security & Tech&Ops Lead is responsible for embedding secure practice and coding at the regional hub of responsibility. In alignment with the strategy and direction of the Head of Application Security, this role will develop and lead the evangelization of application security execution to support strategic and tactical initiatives in application modernization, DevSecOps, artificial intelligence & robotics, multi-cloud adoption, and multi-site application development. This position will directly contribute to the overall global security of ELC’s applications, and will partner with the regional Head of the Technology Hub, the regional Hub lead for application development, and the regional Brand leads (where applications are being developed in brands and regions). This role will also support operational readiness reviews and help with enforcing security requirements within projects and the Software Development Lifecycle (SDLC) as well as Assist with vulnerability response by performing analysis, determining scope and impact, and assisting with remediation of identified vulnerabilities and any incidents. The Regional Head of Application Security & Tech&Ops Lead will develop the regional approach and localized implementation standards for the DevSecOps of the application development hubs in alignment with the strategy set by the Global Head of Application Security, and will work in close partnership with the Development and Technology Operations (DTO) leadership in region to ensure appropriate in-line security tooling and processes of all in-house and out-sourced application development. Must have excellent track record and proven ability to produce effective, innovative solutions at an enterprise scale. Must be constantly evaluating the evolving security, application and technology industries to be on top of the latest innovations and process refinements, making recommendations and influencing adoption by IT, ECR and the broader ELC community. Main duties: Develop and lead the evangelization of an application security operationalization to support strategic initiatives in application modernization, DevSecOps, artificial intelligence & robotics, as well as multi-cloud adoption in region Support operational readiness reviews and help with enforcing security requirements within projects and the Software Development Lifecycle (SDLC) Assist with vulnerability response by performing analysis, determining scope and impact, and assisting with remediation of identified vulnerabilities Work with the latest tool chains and industry best practices using GIT, Jenkins, JIRA, Continuous Integration and Continuous Deployment as decided by the group ECR Architecture head and the CISO Must deliver robust, tested, software with appropriate documentation Develop and deliver training and guidance to empower teams and instill a culture of DevSecOps, in alignment with the awareness and training strategy of the ECR Lead of the same Proactively look for opportunities to automate every aspect of the application and security lifecycle Support the DTO, brand, and interconnected retail application team as well as development teams to design and implement processes and/or tools for secure code reviews and security testing prior to go live Assist in developing application specific threat models to identify security flaws and provide guidance on application specific risks and controls. Design and delivery the approach for and decisions on security tools, configurations, testing, and all process handoffs and security gates into Continuous Integration/Continuous Delivery (CI/CD) pipelines in an Agile environment Lead the deployment, maintenance and adoption of application security tools such as code scanning and code review tools, application vulnerability scanners, etc. in region of responsibility Coordinate and support security audits and assessments to evaluate policy compliance and existing defenses and to identify vulnerabilities Qualifications Technical & functional qualifications: Experience with daily IT operations and best practice frameworks in one or more areas, such as system administration, networking and information security Experience designing and scripting entire cloud environments including networks, app services, databases, and firewall rules with strong knowledge of cloud security controls including tenant isolation, encryption at rest, encryption in transit, key management, vulnerability assessments, and application firewalls Experience application packaging, release automation, and supporting operations and infrastructure Familiarity with toolchains and versions control system, developments, as well as Dynamic Analysis and Static Analysis Security Testing tools Knowledge of risk data architecture and technology solutions Effective in analyzing and developing options to balance business needs with security vulnerabilities Deep understanding of DevSecOps practices, leadership experience in the same Experience operating in agile development processes and integrating secure development practices into these models Excellent programming and scripting skills in languages such as C
, C/C++, Java, JavaScript, PowerShell, Python, etc. Experience developing applications that use modern database platforms such as Microsoft SQL Server, Cassandra, MongoDB, and Cosmos; knowledge of relational database theory and practice Strong understanding of/practical experience with security architecture best practices, standards and frameworks, with emphasis on application security architecture and authorization approaches Experience with APIs: REST, SOAP, SOA and other integrations Knowledge of cloud-based infrastructures and their specific security characteristics Formal training in the primary development toolset: Tools, Code, Application Engine, SQL/DB Security Strong experience with building medium to large enterprise platforms using modern design patterns including micro-services, and resilient architectures Job: Information Technology Primary Location: Europe, Middle East, Africa-RO- Job Type: Standard Schedule: Full-time Shift: 1st (Day) Shift Job Number: 221830