Senior Application Security Expert (AppSec)

Location: Geneva · Contract: Permanent · Assignment: long term · Rate: 80 to 100% · Start: February 2027

For one of our clients based in Geneva, we are looking for an experienced Senior Application Security Expert (AppSec).

Context

The quality and security team of the IT department is deploying its application security strategy (AppSec, "Security by design") with the product teams it supports, with the help of an existing expert AppSec consultant. It wishes to strengthen this setup throughout the deployment phase, aiming to onboard as many applications as possible into the AppSec process.

The assignment covers defining and documenting AppSec best practices, integrating security tools (SAST, DAST, SCA) into CI/CD pipelines, triaging vulnerabilities, training and supporting teams and AppSec champions, as well as monitoring maturity indicators. It concerns both build and run phases, including with a view to open source publication, with a strong requirement for data confidentiality.

Your missions

• Strengthen the deployment of the AppSec approach with product teams, aiming to onboard as many applications as possible into the process

• Integrate and configure security tools (SAST, DAST, SCA) into application CI/CD pipelines and train teams in their use

• Sort, prioritise and qualify security results per application, support teams and contribute to remediation

• Train and support developers and AppSec champions, facilitate workshops and contribute to educational content and implementation guides

• Integrate security into team rituals and practices (design, code review, definition of done), both in build and run

• Monitor AppSec indicators per application and team (scan coverage, vulnerabilities, training) and feed dashboards and reporting

• Contribute to AppSec governance and the champions community, in coordination with the existing consultant and Dev, SecOps and quality teams

• Document security best practices, including for repository management and open source publication, and ensure protection of personal and sensitive data

• Keep abreast of application threats (exploited vulnerabilities, KEV catalogue, AI-related risks) and share with SecOps and teams

Education

• University of Applied Sciences degree, computer science degree, EPF engineering degree or federal diploma

Essential skills

• 5 years or more experience in the role

• Strong expertise in application security: OWASP Top 10 / ASVS, threat modelling, API security (OAuth2 / OIDC), secrets management, personal data protection (nLPD)

• Proven mastery of SAST, DAST and SCA approaches and their integration into CI/CD pipelines (e.g. SonarQube, Checkmarx, OWASP ZAP, Burp Suite, Snyk, Dependency-Check, GitLab CI)

• Risk-based vulnerability management: triage and handling of false positives, CVSS and environmental scoring, exploitability (EPSS, KEV), ability to argue prioritisation or risk acceptance, backlog, deadlines and remediation indicators tracking

• Java / Spring development experience and engineering practices (testing, code reviews, Git) sufficient to support developers on their code

• Experience in threat modelling, application penetration testing and software supply chain security (SBOM)

• Proven change management skills: support adoption of AppSec practices and facilitate tool and process uptake

Desirable skills

• 3 years or more experience in the following skills

• Experience managing security activities: KPI definition, operational monitoring, reporting to governance committees

• Design and delivery of training and awareness workshops tailored to roles (developers, tech leads, product owners)

• Ability to work with multiple teams simultaneously, in a matrix and Agile environment, assess situation criticality and decide or escalate

• Best practices for code repository security, including open source logic (secrets, history, licences)

• Technical supervision and skills transfer: oversee work of an AppSec remediation developer and empower champions to autonomy

A plus

• Experience publishing code as open source: licence, repository hygiene, documentation, cleaning secrets and data before publication

• Use of AI in software development and knowledge of its security risks (data leakage, unsafe generated code, prompt injection), knowledge of OWASP Top 10 for LLM Applications and human-controlled AI-assisted remediation

• Knowledge of ISO/IEC 27034, software quality plan (PQL) and DORA indicators

• Knowledge of containerised environments (Docker, Kubernetes / OpenShift) and their security

• Regular practice of training platforms (Hack The Box, Root-Me, CodeBashing)

Personal qualities

• Communication: adapt to interlocutors (security, development, product, management), simplify, present results

• Pedagogy and change management: convince without hierarchical link, gain adherence rather than impose

• Rigour and discretion: handle vulnerabilities and confidential information with utmost care

• Pragmatism: prioritise by risk, choose remediations achievable by teams

• Team spirit, transparency on risks and issues, openness to change

• Autonomy and sense of responsibility: take initiatives, prioritise without constant supervision