Application Security Lead

Description

Vistex is a global enterprise software and services company that helps businesses manage critical processes covering pricing, trade, royalties and incentives. With Vistex, business stakeholders can see the numbers, understand what drives growth, and make decisions backed by clear financial insights.

The Application Security Lead reports to the IT Security Manager and works closely with Vistex’s Development and Dev Ops teams to embed security in design, implementation, and maintenance of Vistex product services through shift‑left and Dev Sec Ops  approaches. This role can be remote.

• Work closely with Development and Dev Ops teams to develop and enforce secure coding standards and best practices.
• Collaborate to embed security controls into CI/CD pipelines (SAST, SCA, DAST, IaC scanning).
• Participate in design processes for new and existing products to identify, assess, and specify security requirements.
• Conduct threat‑modelling exercises with teams during the design process.
• Engage with teams to develop architecture diagrams and documentation that capture security‑relevant content.
• Ensure integrations with Vistex security tools are factored into the design process.
• Track progress in project meetings and conduct implementation readiness reviews to verify security requirements and documentation.
• Audit products and platforms to confirm complete security coverage.
• Review Dev Ops operations to ensure best practices are followed and identified risks are managed.
• Build strong working relationships with senior stakeholders and team leaders to meet security requirements and implement improvements.
• Participate in risk‑management exercises for software development, Dev Ops, and AI used in Vistex products.
• Provide metrics on secure development maturity and performance.
• Assist in analyzing application layers as required by security incident response processes.
• Maintain awareness of standards and regulatory requirements related to software development.
• Stay informed on current secure development and Dev Ops topics through publications and sources.
• Support the IT Security team in responding to development content in customer security assessments and questionnaires.

The compensation for this position is $120K – $140K annually. Base pay will vary depending on factors, including a candidate’s location, job‑related knowledge, skills and work experience. The compensation package may also include discretionary annual bonus opportunities. Vistex provides competitive benefits including comprehensive healthcare, 401(k), paid time off, and paid volunteerism days.

Associates or better in Information Technology or related field.

Bachelors or better in Information Technology or related field.

• 7–10 years of professional experience.
• Strong written and verbal communication skills (US English), interpersonal and collaborative skills.
• Strong understanding of modern web application and API security, including OWASP Top Ten, CWE, and API‑specific attack vectors.
• Development security experience.
• Practical experience leading application security development programs and implementing shift‑left practices.
• Practical experience working with Dev Ops teams to implement Dev Sec Ops  approaches.
• Hands‑on experience with application security tooling (SAST, SCA, DAST, secrets scanning, IaC scanning) and findings management.
• Experience securing SaaS or cloud‑native platforms.
• Experience with multi‑tenant SaaS security design and data isolation strategies.
• Experience with microservices, containerisation (Docker/Kubernetes), and cloud platforms (GCP, Azure, AWS).
• Experience with OWASP ASVS or NIST CSF frameworks.

Equal Opportunity Employer This employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights notice from the Department of Labor.