Senior Application Security Specialist

Old Mutual is looking for a seasoned professional to steer the Application Security team within their Information and Cybersecurity division. This role is a strategic yet hands-on leadership position, responsible for ensuring that security is seamlessly integrated into every stage of the software development lifecycle. By overseeing the secure design, testing, and deployment of applications—including those involving AI, SaaS, and third-party integrations—the successful candidate will play a pivotal role in safeguarding the organisation’s digital estate.

About the role

As the Application Security Lead, you will bridge the gap between complex security requirements and the realities of modern software delivery. You won’t just be setting standards; you will be actively managing the tooling and verification processes that allow the business to innovate securely. You will lead a dedicated team of analysts, providing technical mentorship while ensuring that security findings are addressed within agreed-upon service level agreements.

The role involves taking ownership of seven critical security domains, ensuring that all software—whether developed in-house, purchased, or cloud-based—meets the rigorous security benchmarks expected in a major financial services environment. You will work closely with development and delivery leads to ensure that security is prioritised during sprint planning, rather than treated as a last-minute hurdle before production.

Your daily focus will be a blend of technical oversight and team leadership, covering:

• **Secure Development Lifecycle:** Defining security requirements, performing threat modelling for new systems, and maintaining security standards across the organisation.
• **Pipeline Security:** Managing code scanning (SAST), software composition analysis (SCA) for open-source components, and secret scanning within CI/CD pipelines.
• **Vulnerability Management:** Coordinating penetration testing with external providers, scoping DAST and API security tests, and managing the re-testing of identified risks.
• **Third-Party & SaaS Governance:** Assessing the security posture of third-party software, reviewing SaaS configurations, and advising on security clauses in procurement contracts.
• **Identity & Access:** Implementing standards for SSO, MFA, API authentication, and web application firewall configurations.
• **AI Security:** Assessing risks specific to AI integrations, including data leakage, prompt injection threats, and secure API key management.
• **Leadership:** Managing the performance and development of your team, cross-skilling analysts to ensure service continuity, and reporting application risk to senior management.

What they're looking for

Old Mutual requires a candidate with a strong foundation in cybersecurity and proven leadership experience. Key requirements include:

• **Qualifications:** A national diploma or degree in Computer Science, Information Systems, or Engineering. Significant experience in the field may be considered as a substitute for formal qualifications.
• **Experience:** At least five years in application security or testing, with a minimum of three years dedicated specifically to application security and at least two years in a leadership or technical lead capacity.
• **Technical Proficiency:** Hands-on experience with SAST, DAST, and SCA tooling, alongside a deep understanding of the OWASP Top 10 and API Security Top 10.
• **Preferred Skills:** Experience within the financial services or insurance sector, familiarity with POPIA, and cloud security knowledge (Azure or AWS). Certifications such as OSCP or CISSP are highly regarded.

In South Africa’s competitive cybersecurity market, roles at this level in large financial institutions typically offer highly attractive packages, often ranging from mid-to-high six-figure monthly salaries, depending on seniority and expertise. This position is ideal for an experienced security professional looking to transition into a leadership role within a major corporate environment, offering a clear growth path toward senior cybersecurity management or architectural roles.

Qualifications and experience

Minimum requirements

• National diploma in Computer Science, Information Systems, Engineering or equivalent. Demonstrable experience may substitute for the qualification.
• 5+ years in application security or security testing, of which at least 3 years in a dedicated application security role.
• 2+ years leading a team, a squad or a security workstream, formally or as a technical lead.
• Hands-on experience with SAST, SCA, DAST and secrets scanning tooling, and with embedding them in CI/CD pipelines.
• Working knowledge of OWASP Top 10, OWASP ASVS and API Security Top 10, and of the SDLC controls expected under a recognised framework such as ISO 27001 or NIST CSF.

Preferred

• One or more of OSCP, CISSP or equivalent.
• Financial services or insurance experience, including familiarity with POPIA and the regulatory expectations on an insurer's software estate.
• Cloud application security experience on Azure or AWS, including container and pipeline security.

Competencies

Technical

• Designs and tunes security tooling in pipelines so it catches real issues without stalling delivery.
• Scopes and interprets penetration tests and can tell a genuine exploit path from a scanner artefact.
• Models threats against modern architectures: APIs, microservices, SaaS integrations and AI services.
• Assesses identity and access design: OAuth 2.0, OIDC, SAML, token handling and WAF policy.
  

 

 

• Matric and relevant Information Technology Qualification – diploma or degree
• 3-5 years Information or cyber security related experience
• Security Awareness and Culture Professional (SACP)
• Excellent interpersonal, communication and presentation skills
• Established experience in phishing simulations and training programs
• Administration of a learning / phishing platform

Additional Qualifications /Experience (Preferred, Not a Requirement)

- Other industry certifications are advantageous (i.e., ISO 27001/27002, CISM, etc.)

Skills

Competencies

Communicates Effectively

Courage

Cultivates Innovation

Decision Quality

Ensures Accountability

Manages Complexity

Nimble Learning

Persuades

Education

Bachelor of Commerce (BCom): Information Technology And Computer Science: Information Technology Management (Required)

Closing Date

11 November 2026 , 23:59

The appointment will be made from the designated group in line with the Employment Equity Plan of Old Mutual South Africa and the specific business unit in question.

The Old Mutual Story!