IT Security Officer (Application & Cloud Security)

About the role

An experienced IT Security Officer (ITSO) is sought to support cybersecurity and application security across IT systems, applications, infrastructure and cloud environments. The role covers security risk assessments, architecture reviews, vulnerability management, incident response and embedding security requirements throughout the application development lifecycle.

Key responsibilities

• Conduct cybersecurity risk assessments for new and existing systems, applications, infrastructure and cloud services.
• Review architecture, data flows, interfaces, APIs and internet-facing entry points to identify risks and vulnerabilities.
• Assess mobile and web applications against application security principles and best practices.
• Perform threat modelling and develop threat profiles, then review remediation plans and evidence.
• Track vulnerabilities and ensure timely patching, closure and remediation.
• Support automated security testing in CI/CD and DevSecOps pipelines.
• Monitor and investigate alerts and incidents (malware, phishing, compromised accounts, data breaches, cloud incidents) and manage them through triage, containment, remediation, recovery and post-incident review.
• Run security awareness sessions and work with developers, infrastructure teams and application owners to address security risks.

Required profile

• Degree in Cybersecurity, Computer Science, Information Technology or a related discipline, or equivalent.
• Minimum 5 years of combined experience in software development, application security and cloud computing, including AWS.
• Strong understanding of mobile and web architectures, APIs and protocols such as REST, SOAP and SSL/TLS.
• Familiarity with Agile, CI/CD and DevSecOps.
• Hands-on experience with SAST/code scanning tools such as Fortify on Demand or SonarQube.
• Good written and verbal communication and independent problem-solving skills.

Required skills

• OWASP Top 10 and OWASP ASVS
• GitLab, GitHub, Ansible
• SAST tools (Fortify on Demand, SonarQube)
• Vulnerability management and incident management