It Offres d'emploi - Québec, QC

Description:

They are looking for an AppSec developer to play a cross-functional and structuring role as a center of excellence in secure development. This person will work closely with the development, CI/CD, and information security teams, as well as the teams responsible for AI governance and responsible use.

Responsibilities:

• Application Security and Security Practices:
  
• Define, maintain, and evolve the security development standards used across Desjardins
  
• Ensure the security of internally developed frameworks
  
• Identify vulnerabilities, assess their risks, and recommend pragmatic and appropriate corrective measures
  
• Promote the secure-by-design and shift-left security approach
  
• Design, develop, and maintain reusable Java security libraries, frameworks, and components across the organization
  
• Integrate application security mechanisms such as authentication, authorization, secure secret management, encryption, traceability, and secure logging
  
• Ensure the security of internally developed frameworks, from their design to their use in production
  
• Conduct code reviews of critical components and propose security and security improvements Maintainability
  
• Support teams in integrating and using common security components
  
• Cross-functional role / AppSec Center of Excellence:
  
• Act as the organizational reference for application security in development
  
• Participate in the development of common patterns, guides, and tools
  
• Foster a shared security culture, aligned with Desjardins' cooperative values
  
• Develop common technological assets enabling the adoption of best security practices by development teams
  
• Act as a mentor and technical advisor to developers on the challenges of secure development and securing Java applications
  
• Participate in the evolution of security services and platforms made available to delivery teams
  
• CI/CD pipeline integration:
  
• Collaborate with DevOps and CI/CD teams to:
  
• Participate in the integration of AppSec controls into pipelines (SAST, DAST, SCA, secrets)
  
• Participate in the implementation of vulnerability monitoring, detection, and remediation tools
  

Description of the Desired Profile

• The client envisions an experienced Java developer with a background specializing in application security, capable of producing code (libraries, frameworks, reusable security components) while also fulfilling a key role a cross-disciplinary reference as an AppSec center of excellence.
  
• The recurring terms (secure by design, shift-left security, OWASP Top 10, CWE, reusable components) indicate an expectation of maturity in securing the code itself, not in network or infrastructure security.
  
• The desired profile is hybrid in the strictest sense: neither a generalist Java developer without a security dimension, nor a security specialist without code production. The influence component (mentoring, bosses, guides, team support) is structural and not secondary: the candidate must have already held a cross-functional role, not just worked within a project team.
  
• The official title "Expert IT Security Developer" is broader than the actual role, which is centered on AppSec and secure Java development, potentially attracting candidates with network security or governance backgrounds.
  

Requirements

Required:

• Demonstrated expertise in application security (AppSec)
  
• Advanced, object-oriented Java development
  
• Development of reusable frameworks, libraries, or technical components
  
• Knowledge of OWASP Top 10 vulnerabilities, CWE, and secure coding practices
  
• Cross-functional role (reference, mentoring, team support)
  

Desired:

• Authentication and authorization: OAuth2, OpenID Connect, JWT, SAML, or equivalent
  
• Security mechanisms: encryption and key management, secrets management, secure logging, data protection, access controls, and API protection
  
• Integration of AppSec controls into CI/CD pipelines: SAST, DAST, SCA, secrets scanning
  

Asset:

• Tools: SonarQube, Wiz, Kubernetes, GitHub, or Azure DevOps
  
• Distributed architectures, microservices, cloud environments
  
• Interest in or knowledge of AI-related security issues