Application Security Manager

easypaisa is Pakistan’s first digital bank, pioneering the country’s digital finance landscape. Supported by prominent shareholders including Telenor Group, a leading telecom operator in Asia and the Nordics, and Ant Group, the force behind Alipay, easypaisa provides secure and convenient financial solutions to millions across Pakistan. The organization is seeking a skilled professional to oversee the secure deployment of servers, applications, containers, and databases, while guiding the team to address security vulnerabilities. This role also involves assisting senior leadership in managing the Information Security Risk Register with a focus on Application Security.

Key Responsibilities:
- Conduct comprehensive assessments such as vulnerability assessments and penetration testing across various platforms including desktop, web, mobile applications, APIs, databases, containers, integrations, and servers.
- Ensure the security of servers, applications, and databases prior to production deployment by overseeing vulnerability assessments and penetration testing activities.
- Provide expert guidance to developers and system administrators on securing environments and resolving identified security gaps.
- Perform vulnerability assessments and penetration testing on cloud-based applications, whether developed internally or sourced from third parties, and track progress using a smart sheet tool.
- Review Business Requirement Documents (BRD) and Product Requirement Documents (PRD) for both internal change requests and third-party integrations.
- Actively participate in Cross Functional Team (CFT) meetings and review phased third-party integration flows.
- Conduct static and dynamic security analyses, along with penetration testing for mobile and web applications to detect security weaknesses.
- Assess all third-party integrations and APIs following a defined roadmap and plan.
- Lead a team responsible for both scheduled and ad-hoc security reviews, ensuring timely resolution of security issues.
- Maintain a detailed tracker of assessments and follow up with relevant teams to monitor vulnerability remediation and prioritize timelines.
- Review information security requirements related to contract agreements with external business partners.
- Prepare and present reports to stakeholders, highlighting risks, recommending mitigation strategies, and tracking implementation progress.
- Engage with developers and system administrators to provide security training, clarify information security requirements, and assist in resolving findings.
- Develop metrics programs focused on secure development and data loss prevention initiatives.
- Participate in the organization’s Information Security Awareness Program.
- Conduct regular security audits from both theoretical and practical perspectives to evaluate the effectiveness of security controls.
- Contribute to Information Security Risk Assessments and share findings through detailed reports.
- Perform any additional duties assigned by the Head of Information Security or Chief Information Security Officer (CISO).

Required Qualifications:
- Bachelor’s degree in Computer Science, Information Security, Engineering, or a related field from a reputable institution.
- Minimum of 5 years of hands-on experience in server and application vulnerability scanning, as well as penetration testing.
- At least 2 to 3 years of direct experience in Application Security, including vulnerability scanning and penetration testing of servers and applications.

Preferred Qualifications and Additional Skills:
- Relevant professional certifications related to application security and penetration testing will be an advantage.
- Familiarity with recognized security frameworks such as MITRE ATT&CK, OWASP, and OSTTM is highly desirable.

This role offers the opportunity to work at the forefront of digital banking security, contributing to the protection of critical financial infrastructure and enhancing the security posture of a leading digital financial services provider.