Description:

They are
looking for an AppSec developer to play a cross-functional and structuring role
as a center of excellence in secure development. This person will work closely
with the development, CI/CD, and information security teams, as well as the
teams responsible for AI governance and responsible use.

Responsibilities:

• 
  Application
  Security and Security Practices:

• 
  Define, maintain,
  and evolve the security development standards used across Desjardins
• 
  Ensure the
  security of internally developed frameworks
• 
  Identify
  vulnerabilities, assess their risks, and recommend pragmatic and appropriate
  corrective measures
• 
  Promote the
  secure-by-design and shift-left security approach
• 
  Design,
  develop, and maintain reusable Java security libraries, frameworks, and
  components across the organization
• 
  Integrate
  application security mechanisms such as authentication, authorization, secure
  secret management, encryption, traceability, and secure logging
• 
  Ensure the
  security of internally developed frameworks, from their design to their use in
  production
• 
  Conduct
  code reviews of critical components and propose security and security
  improvements Maintainability
• 
  Support
  teams in integrating and using common security components

• 
  Cross-functional
  role / AppSec Center of Excellence:

• 
  Act as the
  organizational reference for application security in development
• 
  Participate
  in the development of common patterns, guides, and tools
• 
  Foster a
  shared security culture, aligned with Desjardins' cooperative values
• 
  Develop
  common technological assets enabling the adoption of best security practices by
  development teams
• 
  Act as a
  mentor and technical advisor to developers on the challenges of secure
  development and securing Java applications
• 
  Participate
  in the evolution of security services and platforms made available to delivery
  teams

• 
  CI/CD
  pipeline integration:

• 
  Collaborate
  with DevOps and CI/CD teams to:
• 
  Participate
  in the integration of AppSec controls into pipelines (SAST, DAST, SCA, secrets)
• 
  Participate
  in the implementation of vulnerability monitoring, detection, and remediation
  tools

Description of
the Desired Profile

• 
  The client
  envisions an experienced Java developer with a background specializing in
  application security, capable of producing code (libraries, frameworks,
  reusable security components) while also fulfilling a key role a
  cross-disciplinary reference as an AppSec center of excellence.
• 
  The recurring
  terms (secure by design, shift-left security, OWASP Top 10, CWE, reusable components)
  indicate an expectation of maturity in securing the code itself, not in network
  or infrastructure security.
• 
  The desired
  profile is hybrid in the strictest sense: neither a generalist Java developer
  without a security dimension, nor a security specialist without code
  production. The influence component (mentoring, bosses, guides, team support)
  is structural and not secondary: the candidate must have already held a
  cross-functional role, not just worked within a project team.
• 
  The official
  title "Expert IT Security Developer" is broader than the actual role,
  which is centered on AppSec and secure Java development, potentially attracting
  candidates with network security or governance backgrounds.

Requirements

Required:

• 
  Demonstrated
  expertise in application security (AppSec)
• 
  Advanced,
  object-oriented Java development
• 
  Development of
  reusable frameworks, libraries, or technical components
• 
  Knowledge of
  OWASP Top 10 vulnerabilities, CWE, and secure coding practices
• 
  Cross-functional
  role (reference, mentoring, team support)

Desired:

• 
  Authentication
  and authorization: OAuth2, OpenID Connect, JWT, SAML, or equivalent
• 
  Security
  mechanisms: encryption and key management, secrets management, secure logging,
  data protection, access controls, and API protection
• 
  Integration of
  AppSec controls into CI/CD pipelines: SAST, DAST, SCA, secrets scanning

Asset:

• 
  Tools: SonarQube,
  Wiz, Kubernetes, GitHub, or Azure DevOps
• 
  Distributed
  architectures, microservices, cloud environments
• 
  Interest in or
  knowledge of AI-related security issues