Senior Application Security Developer (AppSec)

Location: Geneva · Contract: Permanent · Assignment: long term · Rate: 80 to 100% · Start: February 2027

For one of our clients based in Geneva, we are looking for an experienced Senior Application Security Developer (AppSec).

Context

The Custom Development team is deploying its application security strategy (AppSec, "Security by design") with the product teams it supports, with the help of an expert AppSec consultant already in place. You will strengthen this setup throughout the deployment phase, aiming to onboard as many applications as possible into the AppSec process.

Your scope covers defining and documenting AppSec best practices, integrating security tools (SAST, DAST, SCA) into CI/CD pipelines, triaging vulnerabilities, training and supporting teams and AppSec champions, as well as monitoring maturity indicators.

You will be involved in both build and maintenance phases (build and run), including with a view to open source publication, and uphold a strong requirement for data confidentiality.

Your missions

• Strengthen the deployment of the AppSec approach with product teams, aiming to onboard as many applications as possible into the process

• Integrate and configure security tools (SAST, DAST, SCA) into application CI/CD pipelines and train teams in their use

• Sort, prioritise and qualify security results per application; support teams and contribute to remediation

• Train and support developers and AppSec champions; facilitate workshops and contribute to educational content and implementation guides

• Integrate security into team rituals and practices (design, code review, definition of done), both in build and run phases

• Monitor AppSec indicators per application and team (scan coverage, vulnerabilities, training) and feed dashboards and reporting

• Contribute to AppSec governance and the champions community; coordinate actions with the consultant in place and Dev, SecOps and quality teams

• Document security best practices, including for repository management and open source publication, and ensure protection of personal and sensitive data

Education

• HES degree, computer science degree, EPF engineering diploma or federal diploma

Essential skills

• 5 years or more experience in a similar role

• Strong expertise in application security: OWASP Top 10 / ASVS, threat modelling, API security (OAuth2 / OIDC), secret management, personal data protection (LPD)

• Proven mastery of SAST, DAST and SCA approaches and their integration into CI/CD pipelines (e.g. SonarQube, Checkmarx, OWASP ZAP, Burp Suite, Snyk, Dependency-Check, GitLab CI)

• Vulnerability management by risk: triage and handling of false positives, CVSS and environmental scoring, exploitability (EPSS, KEV), ability to argue prioritisation or risk acceptance; backlog tracking, meeting deadlines and remediation indicators

• Experience in Java / Spring development and engineering practices (testing, code reviews, Git) sufficient to support developers on their code

• Experience in threat modelling, application penetration testing and software supply chain security (SBOM)

• Proven change management skills: support adoption of AppSec practices and facilitate uptake of tools and processes

Desirable skills

• 3 years or more experience in the following skills

• Experience managing security activities: KPI definition, operational monitoring, reporting to governance committees

• Design and delivery of training and awareness workshops tailored to roles (developers, tech leads, product owners)

• Ability to work with multiple teams simultaneously, in a matrix and Agile environment; assess criticality of situations and decide or escalate

• Best practices for code repository security, including in an open source context (secrets, history, licences)

A plus

• Experience publishing code as open source: licensing, repository hygiene, documentation, cleaning secrets and data before publication

• Use of AI in software development and knowledge of its security risks (data leaks, unsafe generated code, prompt injection)

• Knowledge of ISO/IEC 27034, software quality plans and DORA indicators

• Knowledge of containerised environments (Docker, Kubernetes / OpenShift) and their security

Personal qualities

• Communication: adapt to interlocutors (security, development, product, management), simplify, present results

• Pedagogy and change management: persuade without hierarchical authority, gain buy-in rather than impose

• Rigour and discretion: handle vulnerabilities and confidential information with utmost care

• Pragmatism: prioritise by risk, choose remediations achievable by teams

• Team spirit, transparency about risks and issues, openness to change

• Autonomy and sense of responsibility: take initiative, prioritise without constant supervision