Application Security Consultant

ROLE PURPOSE

The aim is to state the overall significance of the job from the organization’s perspective. The role exists to perform application security assessments and support the integration of security throughout the software development lifecycle by identifying application vulnerabilities, conducting code and design reviews, assessing APIs and integrations, and providing security guidance to development teams to strengthen the security of Elm's applications and digital solutions.

Job Title: Consultant

Job Code: 680865

Grade: I3

Division: Legal, Risk & Governance

Department: Cybersecurity

Unit: Application Security

• Application Security Assessment
• Perform security assessments for applications and digital solutions.
• Evaluate applications against approved security requirements and standards.
• Document identified vulnerabilities, risks, and recommended remediation actions.
• Secure Code Review
• Conduct security-focused source code reviews to identify vulnerabilities and insecure coding practices.
• Assess code against secure coding standards and common application security risks.
• Provide remediation guidance to development teams.
• Threat Modeling
• Conduct threat modeling for new and existing applications and services.
• Identify potential attack scenarios, threats, and security control gaps.
• Recommend security controls based on identified risks.
• Application Vulnerability Management
• Identify, analyze, and assess application-layer vulnerabilities.
• Coordinate with development teams on vulnerability remediation activities.
• Validate remediation and monitor outstanding application security findings.
• API & Integration Security
• Assess APIs, microservices, and third-party integrations for cybersecurity risks.
• Evaluate authentication, authorization, data protection, and integration controls.
• Recommend appropriate security improvements.
• Secure Design & Development Advisory
• Provide security guidance to development and engineering teams throughout the development lifecycle.
• Support the application of secure design and development practices.
• Recommend security controls appropriate to solution risks and requirements.
• Application Security Standards & Frameworks
• Develop and maintain application security standards, guidelines, and technical requirements.
• Support alignment with secure software development practices and applicable cybersecurity standards.
• Evaluate emerging application security practices and recommend enhancements.
• Developer Security Awareness
• Support secure coding awareness and technical security training for developers.
• Develop security guidance and knowledge materials addressing common application vulnerabilities.
• Promote secure development practices across engineering teams.
• Policies, Processes & Procedures
• Follow all relevant departmental policies, processes, standard operating procedures, and instructions so that work is carried out in a controlled and consistent manner.
• Comply with all relevant safety, quality, and environmental management policies, procedures, and controls to ensure a healthy and safe work environment.
• Information Security
• Comply with all relevant information security practices and standards to ensure data integrity and confidentiality.

• Bachelor's degree in Cybersecurity, Computer Science, Software Engineering, Computer Engineering, or a related field.
• Professional certifications in Application Security, Secure Software Development, or related cybersecurity disciplines are considered an advantage.

• 4–6 years of experience in application security, secure software development, security assessments, vulnerability management, or related cybersecurity domains.