Application Security Lead (SAST, AI)

About the role

A leading financial services organisation in Abu Dhabi is looking for an Application Security Lead to lead its application security programme across software engineering teams. The role owns the application security strategy, tooling, governance and secure coding initiatives across cloud-native and modern software environments, and drives the adoption of AI-powered security capabilities.

Key responsibilities

• Lead and mature the application security programme and own the SAST strategy, tooling, policies and processes.
• Drive secure code practices throughout the SDLC and establish security standards, frameworks and governance.
• Manage source repository security in GitLab and oversee vulnerability management, from identification and prioritisation to remediation tracking and reporting.
• Partner with engineering leaders to embed security-by-design and design and deliver secure coding training.
• Introduce and operationalise AI-assisted application security, evaluate risks around AI coding assistants and AI-generated code, and govern related security risks.
• Drive adoption of security tooling, metrics and reporting, and provide subject matter expertise on secure architecture and controls.
• Work with DevOps, Cloud and Platform Engineering teams to secure cloud-native applications, containers and CI/CD environments.

Required profile

• 7+ years in software engineering and/or application security, including 3+ years in a dedicated application security role.
• Hands-on experience with SAST, dependency scanning, vulnerability management and secure SDLC practices.
• Experience securing source code repositories and CI/CD pipelines, ideally in GitLab.
• Experience with cloud-native application security, container security and DevSecOps.
• Knowledge of OWASP Top 10, OWASP Top 10 for LLM applications and secure coding principles.
• Familiarity with ISO 27001 and application security governance frameworks.
• Previous experience in financial services, banking or FinTech preferred.

Required skills

• Proficiency in at least two of Python, Java, Go or TypeScript.
• Technical ownership of SAST, GitLab source repository security, dependency and supply chain security, vulnerability monitoring and AI-driven security tooling.