Expert IT Security Developer

Description:

They are looking for an AppSec developer to play a cross-functional and structuring role as a center of excellence in secure development. This person will work closely with the development CI/CD and information security teams as well as the teams responsible for AI governance and responsible use.

Responsibilities:

• Application Security and Security Practices:
  

• Define maintain and evolve the security development standards used across Desjardins
  
• Ensure the security of internally developed frameworks
  
• Identify vulnerabilities assess their risks and recommend pragmatic and appropriate corrective measures
  
• Promote the secure-by-design and shift-left security approach
  
• Design develop and maintain reusable Java security libraries frameworks and components across the organization
  
• Integrate application security mechanisms such as authentication authorization secure secret management encryption traceability and secure logging
  
• Ensure the security of internally developed frameworks from their design to their use in production
  
• Conduct code reviews of critical components and propose security and security improvements Maintainability
  
• Support teams in integrating and using common security components
  

• Cross-functional role / AppSec Center of Excellence:
  

• Act as the organizational reference for application security in development
  
• Participate in the development of common patterns guides and tools
  
• Foster a shared security culture aligned with Desjardins cooperative values
  
• Develop common technological assets enabling the adoption of best security practices by development teams
  
• Act as a mentor and technical advisor to developers on the challenges of secure development and securing Java applications
  
• Participate in the evolution of security services and platforms made available to delivery teams
  

• CI/CD pipeline integration:
  

• Collaborate with DevOps and CI/CD teams to:
  
• Participate in the integration of AppSec controls into pipelines (SAST DAST SCA secrets)
  
• Participate in the implementation of vulnerability monitoring detection and remediation tools
  

Description of the Desired Profile

• The client envisions an experienced Java developer with a background specializing in application security capable of producing code (libraries frameworks reusable security components) while also fulfilling a key role a cross-disciplinary reference as an AppSec center of excellence.
  
• The recurring terms (secure by design shift-left security OWASP Top 10 CWE reusable components) indicate an expectation of maturity in securing the code itself not in network or infrastructure security.
  
• The desired profile is hybrid in the strictest sense: neither a generalist Java developer without a security dimension nor a security specialist without code production. The influence component (mentoring bosses guides team support) is structural and not secondary: the candidate must have already held a cross-functional role not just worked within a project team.
  
• The official title "Expert IT Security Developer" is broader than the actual role which is centered on AppSec and secure Java development potentially attracting candidates with network security or governance backgrounds.
  

Required:

• Demonstrated expertise in application security (AppSec)
  
• Advanced object-oriented Java development
  
• Development of reusable frameworks libraries or technical components
  
• Knowledge of OWASP Top 10 vulnerabilities CWE and secure coding practices
  
• Cross-functional role (reference mentoring team support)
  

Desired:

• Authentication and authorization: OAuth2 OpenID Connect JWT SAML or equivalent
  
• Security mechanisms: encryption and key management secrets management secure logging data protection access controls and API protection
  
• Integration of AppSec controls into CI/CD pipelines: SAST DAST SCA secrets scanning
  

Asset:

• Tools: SonarQube Wiz Kubernetes GitHub or Azure DevOps
  
• Distributed architectures microservices cloud environments
  
• Interest in or knowledge of AI-related security issues