Senior Application Security Analyst

As a consultant representing Keystone Solutions, you will be responsible for:

• Managing technical controls for Secure Application Lifecycle Management (SALM) and integrating them into development practices.
• Utilizing results from tools to qualify vulnerabilities, assist in their remediation, and contribute to the automation of controls in CI/CD pipelines.
• Determining application criticality and applicable security controls.
• Conducting risk analyses and monitoring measures according to established methodologies.
• Defining application security standards and practices.
• Integrating security controls into DevSecOps/CI/CD projects, including SAST, DAST, SCA, vulnerability scans, and penetration testing.
• Monitoring exceptions, residual risks, and recommendations prior to production deployment.
• Advising project, development, architecture, and operations teams.

Expected Behavioral Skills:

• Technical rigor: reproduce, qualify, and document findings.
• Pragmatism: prioritize exploitable vulnerabilities and propose realistic corrections.
• Pedagogy: explain vulnerabilities and remediations to developers.
• Curiosity: keep knowledge updated on attack techniques and tools.
• Autonomy: configure and operate controls while escalating complex cases.
• Collaboration: work with projects, developers, DevSecOps, SecOps, and providers.

Why Join Keystone Solutions?

As a consultant at Keystone Solutions, you will experience:

• Consultancy Nature: Focus on on-site work and embodying the consultant identity.
• Dynamic Projects: Engage with diverse challenges across various client environments.
• Turbo-Charged Learning: Benefit from professional development and broad learning experiences.
• Skyrocketing Ambition: Enjoy a commitment to career growth within our framework.
• Values: Being a “K-Stone” means bringing our core values to every engagement.

• Analyse et qualification des vulnrabilits : exploitabilit, impact, faux positifs et priorisation
• (mandatory) - Level: T3 - Senior - Most recent: Any time
• Architecture et scurit applicative : flux, authentification, autorisation, chiffrement, API et dpendances
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Chanes CI/CD et pratiques DevSecOps : intgration, paramtrage, automatisation et quality gates
• (mandatory) - Level: T3 - Senior - Most recent: Any time
• Outils de scurit applicative : SAST, DAST, SCA, dtection de secrets et scans de vulnrabilits
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Rfrentiels techniques : OWASP Top 10, ASVS, SAMM, CWE, CVSS et NIST SSDF
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Restitution technique, documentation et accompagnement des quipes de dveloppement
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Scurit du dveloppement, API, dpendances logicielles, conteneurs et gestion des secrets
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time

Language requirements:

French (mandatory) Level Proficiency (C2)