Application Security Lead (m/f/d)
As a leading international food wholesaler, METRO specializes in catering to HoReCa, Traders, and other customers. With approximately 15 million customers worldwide, our multichannel mix offers in-store and METRO MARKETS delivery. We are committed to sustainability and operate in 32 countries with over 90,000 employees and sales around €30 billion in 2022/23.
At METRO, we have set ambitious goals with our sCore growth strategy accompanied by the Fundamentals. Our ONE METRO spirit emphasizes curiosity, determination, courage, drive, commitment, and trust. Find out more at careers.metroag.de.
Job Description
The purpose of this role is to define the security requirements for the cloud platforms utilized at METRO based on industry standards and regulations and to monitor their fulfillment. This role requires knowledge of common security threats, security controls and related technologies and practices for securing IaaS, PaaS, and SaaS cloud platforms, cloud services, and related IT resources.
Responsibilities
* Contribute to develop relevant guidelines and standards related to application security, cryptography management and relevant areas for software development.
* Contribute to ensure that each step of the software development lifecycle (SDLC) used by software engineers across METRO follows best practices in information security and data privacy.
* Contribute to develop and maintain technologies and processes for continuous software development (CI/CD) to include gates that validate security controls automatically during development and deployment.
* Support software engineer teams across METRO to address identified software vulnerabilities and weaknesses.
* Support cyberdefense and software engineer teams in case of identified risks or security alerts related to software or third-party libraries vulnerabilities to determine METRO’s exposure.
Qualifications
* Relevant Master’s degree in Computer Science, Information Security, or a related field
* Minimum of 3 years of experience in cyber security, application security or software engineering
* Familiarity with information security standards (e.g., OWASP, ISO 27001, NIST)
* Familiarity with threat modeling (e.g., STRIDE) to identify threats and vulnerabilities
* Proven experience implementing DevSecOps by integrating SCA, DAST and SAST in CI/CD pipelines
* Familiarity with vulnerability prioritization approaches
* Ability to build detailed and actionable analysis reports
* Proven project management abilities and ability to deliver projects on time and within budget
* Effective stakeholder management with strong communication and coordination skills
* Broad knowledge of security architectures and security systems in IT and OT environments
* Fluent English
Additional Information
* Work-life balance: Flexible hours with optional mobile working, 30 days of holidays
* Training: Comprehensive training via METRO or external providers
* Well-being: Health days, preventive services, and employee assistance program
* Exciting campus life: Free gym and sports classes, coffee bar, discounted meals, campus events
* Discounts: Discounted Jobticket and store/partner discounts
* Comfort: Good transport connections, free parking, JobBike
* Company pension: Contributions to company pension
* Family support: On-site daycare centers and holiday camps for employees
#J-18808-Ljbffr