DAST Program and Technical Lead

About the Role

Join the Attack Surface Management team as the Dynamic Application Security Testing (DAST) Program and Technical Lead. The position supports a U.S.-based financial services client expanding their automated DAST coverage across the full application portfolio by embedding it into their DevSecOps CI/CD pipelines. This is a hands-on role blending deep technical leadership with program delivery responsibilities, encompassing technical ownership of DAST tooling and configurations, as well as driving the successful rollout and ongoing management of the DAST initiative.

Key Responsibilities

• Serve as the leading technical authority for automated DAST integration in DevSecOps CI/CD, establishing and enforcing security best practices.
• Evaluate and conduct proof-of-concept testing of potential DAST vendor tools, assessing their coverage of web applications and APIs to inform procurement decisions.
• Define the integration points of DAST scans in CI/CD pipelines, including build/release gates, scheduling, authentication, and environment prerequisites, providing technical direction to DevOps teams.
• Create and refine scan policies, authentication setups, and profiles to optimize true positive detection while minimizing false positives and pipeline interruptions.
• Analyze and validate scanner output to distinguish genuine vulnerabilities from noise before communicating results to application teams.
• Develop operational protocols covering application onboarding, scanning frequencies, service levels, escalation procedures, and reporting mechanisms ensuring comprehensive portfolio coverage.
• Collaborate closely with application developers throughout remediation cycles—explaining findings, suggesting prioritization, and confirming fixes.
• Maintain harmony between automated DAST and existing risk-based penetration testing strategies by preserving manual testing for high-risk applications.
• Contribute to the creation and revision of security policies, standards, and governance documentation targeted at both technical audiences and leadership.
• Stay updated on emerging DAST technologies, threat vectors, and application security trends to continually enhance program efficacy.

Candidate Profile

• Significant experience in application security or penetration testing focusing on web and API environments, with a strong understanding of the OWASP Web Security Testing Guide (WSTG).
• Hands-on expertise with DAST scanners, including configuring authenticated scans and tuning detection rules.
• Ability to operate effectively both as a practical security expert and as a program coordinator, managing timelines and stakeholder communication.
• Experience integrating security tools within CI/CD and DevSecOps systems like Jenkins, Azure DevOps, GitLab CI, or GitHub Actions, with proficiency in API-based automation and release gating concepts.
• Robust knowledge of vulnerability types across web, API, and desktop applications and their detection through automated and manual tests.
• Proficiency using CVSS scoring to evaluate risks and prioritize vulnerabilities logically.
• Skill in triaging large volumes of scanner data, accurately identifying true positives and articulating risk to stakeholders.
• Track record of providing actionable remediation guidance and supporting development teams throughout vulnerability mitigation workflows.
• Experience managing program workstreams, including planning, progress tracking, and updating senior stakeholders.
• Familiarity with issue tracking and workflow tools such as Jira.
• Excellent communication skills to convey technical directions to engineers and clarify risks to diverse audiences.
• Proven skills in producing clear, structured documentation, policies, and reports grounded in evidence.

Desirable Expertise

• Hands-on experience selecting and piloting commercial DAST solutions, including evaluating vendors and conducting proof-of-concept trials.
• Programming or scripting skills (e.g., Python) for scanner API automation and pipeline integration.
• Specialized experience in API security testing including REST, GraphQL, SOAP, and OpenAPI-driven scanning.
• Knowledge of complementary application security tools like Static Application Security Testing (SAST) and Software Composition Analysis (SCA) within DevSecOps workflows.
• Experience with ServiceNow for vulnerability and remediation tracking.
• Familiarity with secrets management tools (e.g., HashiCorp Vault, CyberArk) for secure handling of scan credentials.
• Relevant industry certifications such as Burp Suite Certified Practitioner, Offensive Security Certified Professional, or equivalent.
• Experience operating or defining application security at portfolio scale with metrics, SLAs, and governance.
• Previous work in financial services or other regulated sectors.
• Additional language skills in Japanese, Spanish, or Portuguese considered advantageous.

Rewards and Benefits

The employer is recognized consistently as a top employer offering comprehensive compensation packages including pension, healthcare, life insurance, and laptop provision. Employees access broad training resources and discounts across a global network. Wellness programs and sponsored events such as the London Marathon bolster community engagement and personal health.

Diversity, Inclusion and Accessibility

The company upholds strong commitments to equality and inclusiveness across diverse demographics including disability, neurodiversity, gender identity, age, and more. They operate as a Disability Confident Employer offering interview opportunities to applicants with disabilities who meet core criteria and provide application/interview adjustments upon request.

Fraud Awareness

The organization does not request any payment or deposits during recruitment and only communicates through authorized channels. Applicants should remain vigilant of fraudulent recruitment activity and can report suspicious behavior to official contacts provided.

Application Note

Due to the volume of applications, individual communication may not be guaranteed. Applicants not contacted within 30 days should consider their application unsuccessful.