Application Security Officer

Job description

Responsibilities The Information Security Risk Officer is responsible for leading and advancing the organization's technology risk assessment, and application security risk programs. This role serves as a subject matter expert in identifying, assessing, evaluating, and communicating information security risks arising from internally developed applications, third-party service providers, cloud platforms, and technology solutions. As a key member of the Cyber Threat Defense (CTD) team, this individual provides independent risk-based guidance to business and technology stakeholders, ensuring information security risks are appropriately identified, measured, monitored, and managed. The role requires strong technical knowledge of application security, cloud technologies, cybersecurity frameworks, and risk management methodologies to support informed business decision-making in a dynamic threat landscape. Key Responsibilities Technology, Application Security, and Cloud Risk Management

- Lead information security risk assessments for applications, technology platforms, cloud services, and strategic initiatives, ensuring risks are identified and evaluated in accordance with established risk management frameworks.

- Assess the effectiveness of security controls and identify gaps related to application security, infrastructure security, cloud deployments, and third-party integrations.

- Review application architectures, security controls, and development practices and provide risk-based recommendations to help the business manage their risk.

- Evaluate security risks associated with cloud technologies, including Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) environments.

- Analyze emerging threats, vulnerabilities, and cybersecurity trends to determine potential impacts to the organization and recommend mitigation strategies.

- Facilitate risk treatment activities and track remediation efforts through completion, escalating significant risk issues where appropriate.

- Support governance, audit, and regulatory activities by providing risk assessments, control evaluations, and security documentation.

Risk Governance and Reporting

- Prepare and present risk assessment results, risk acceptance recommendations, and security findings to management and relevant governance forums.

- Maintain risk metrics, reporting, and dashboards to support effective risk oversight and decision-making.

- Regularly provide status updates and reporting to senior management, audit functions, and regulatory stakeholders.

- Contribute to the development and enhancement of information security policies, standards, procedures, and risk management practices.

- Assist with internal and external examinations, audits, and regulatory reviews involving cybersecurity and technology risk management.

Advisory and Program Support

- Research emerging cybersecurity, application security, regulatory, and industry trends to assess potential impacts on the organization's risk posture.

- Support the continuous improvement of technology risk management, application security risk management, and third-party risk management processes.

- Participate in strategic initiatives, special projects, and ad hoc risk assessments as required.

Profile Knowledge and Experience

- 5+ years of experience in information security, cybersecurity risk management, application security, technology risk, or related discipline.

- Strong understanding of information security risk management principles, methodologies, and control frameworks.

- Experience conducting technology, application, cloud, and third-party security risk assessments.

- Working knowledge of cybersecurity and risk frameworks including:

- NIST Cybersecurity Framework (CSF)

- NIST SP 800-53

- ISO/IEC 27001

- OWASP Top 10

- CIS Controls

- Strong understanding of application security concepts including secure development practices, vulnerability management, code scanning, authentication, authorization, and application security testing.

- Familiarity with security technologies including vulnerability management, endpoint security, identity and access management, network security, and cloud security controls.

- Strong analytical, risk assessment, problem-solving, and critical thinking capabilities.

- Excellent written and verbal communication skills with the ability to communicate complex technical risks to both technical and non-technical audiences.

- Demonstrated project management, stakeholder management, and program coordination experience

Societe Generale is committed to offering an inclusive recruitment experience to all candidates. If you require any reasonable accommodations during the recruitment process, please do not hesitate to let our Recruiters know. OUR CULTURE: At Societe Generale, we live by our 4 core values of commitment, responsibility, team spirit and innovation. We are engaged and demonstrate consideration for others. We act ethically and with courage. We focus our talent and energy on collective success. We experiment and propose new ideas. This way, we maximize our ability to serve client needs and anticipate market changes. Societe Generale is committed to strengthening bonds with colleagues, communities, and the world in which we live, because relationships are at the heart of how we operate. For more information about our Culture and Conduct initiatives, please visit this link (https://americas.societegenerale.com/en/careers/get-know-culture/) DIVERSITY, INCLUSION & BELONGING (“DIB”): Our DIB Mission: Recruit, develop, retain and advance a talented workforce that is united in our efforts to leverage our talent and further develop an inclusive environment that will enhance our competitive position and deliver innovative solutions to our clients. It seeks to foster an environment where employee differences are valued and where all employees feel engaged, supported, respected, and informed. For more information about our DIB initiatives, please visit this link: https://americas.societegenerale.com/en/careers/get-know-diversity/ USE OF AI GUIDELINES FOR CANDIDATES: Société Générale permits responsible use of artificial intelligence (AI) in recruitment. Information provided by candidates must authentically reflect their own skills and experience. AI must not be used for real-time interview coaching, to complete assessments, or to generate responses during interviews. Misuse may undermine the integrity of the process and result in exclusion. This restriction does not apply to assistive technologies used for accessibility or disability-related purposes. COMPENSATION: Base salary range does not include overtime pay, bonus and/or other benefits, where applicable. Actual base salary offer will vary based on skills and experience. The role is eligible for an annual discretionary bonus and includes a competitive benefits package including 401(k) plan with company match, medical/dental/vision, and other benefits for fertility, wellness, student loans and commuters.