Lead Application Security Engineer - VP

JR000996

Glasgow

Morgan Stanley is looking for a motivated Engineering lead to join the Cybersecurity department, who will be charged with enabling security controls in the CI/CD pipelines by rolling out SAST, SCA or DAST tools with a significant impact to the development community and to the security posture of firm’s applications.

In the Technology division, we leverage innovation to build the connections and capabilities that power our Firm, enabling our clients and colleagues to redefine markets and shape the future of our communities. This is a Software Engineering Manager position at VP, P5 level, which is part of the job family responsible for developing and maintaining software solutions that support business needs.

Morgan Stanley is an industry leader in financial services, known for mobilizing capital to help governments, corporations, institutions, and individuals around the world achieve their financial goals.

Interested in joining a team that's eager to create, innovate and make an impact on the world? Read on.

What You’ll Do

• Work with a team of engineers to implement Morgan Stanley specific security policies in the CI/CD security tools including but not limited to SAST, DAST and SCA applications.
• Work with Development, DevOps and Security teams to identify and develop automated security and compliance capabilities in support of DevOps processes.
• Define the security rules that needs to be adhered to at a code level in web and mobile applications written in Java, React, Objective C, SWIFT, Kotlin etc.
• With your development background and security knowledge, provide security guidance to developers in the form secure coding standards and guidelines.
• Support security standards, create templates and patterns to increase the efficiency and adoption of security program.
• Work with our partners to implement, manage, and optimizing security measures within our GitHub repositories and pipelines to continuously improve code security and protect against vulnerabilities.
  
  

These Skills Will Help You Succeed In This Role

• Bachelor’s degree with 10+ years of work experience in the IT field
• 3+ years software development experience using Python, Java or JavaScript
• 3+ years of cumulative experience across the following:
• OWASP Secure Coding Practices
• Common software and web application security vulnerabilities
• Application security scanning tools
• Continuous Integration/Continuous Deployment (CI/CD) processes and concepts using relevant technologies and tools (e.g., Jenkins)
  

Even Better If You Have

• A degree in Cybersecurity or CISSP/CSSLP certification or keen desire to move to security field
• Business acumen to support the implementation of SAST, DAST, SCA, Container Security, API Security and IaC tools across the enterprise
• Ability to perform code reviews with minimal assistance
• A self-starter, with a strong desire for learning new technologies and applying them to solve problems
• Expertise in monitoring, alerting, reporting, data analysis is desired.
• Experience with two or more of the application build environments like Jenkins, Gradle, Maven.
• Familiarity with public cloud services a plus
• Experience with two or more of the Secure SDLC tools like Github Advanced Security, Snyk, WhiteSource, Sonatype, X-Ray, Wiz.
• Experience with Threat Analysis.
• Experience with DevSecOps, Secure SDLC.
• DevOps container/orchestration tools (Kubernetes, Docker, Puppet, etc) is a plus
• Experience with evaluation, integration and onboard of application security tools is a plus
  
  

What You Can Expect From Morgan Stanley

We are committed to maintaining the first-class service and high standard of excellence that have defined Morgan Stanley for over 85 years. At our foundation are five core values — putting clients first, doing the right thing, leading with exceptional ideas, committing to diversity and inclusion, and giving back — that guide our more than 80,000 employees in 1,200 offices across 42 countries. At Morgan Stanley, you’ll find trusted colleagues, committed mentors and a culture that values diverse perspectives, individual intellect and cross-collaboration. We Firm is differentiated by the caliber of our diverse team. While our company culture and commitment to inclusion define our legacy and shape our future, helping to strengthen our business and bring value to clients around the world. Learn more about how we put this commitment to action: morganstanley.com/diversity. We are proud to support our employees and their families at every point along their work-life journey, offering some of the most attractive and comprehensive employee benefits and perks in the industry.

We're committed to bringing passion and customer focus to the business.

Certified Persons Regulatory Requirements

If this role is deemed a Certified role and may require the role holder to hold mandatory regulatory qualifications or the minimum qualifications to meet internal company benchmarks.

Flexible work statement

Interested in flexible working opportunities? Morgan Stanley empowers employees to have greater freedom of choice through flexible working arrangements. Speak to our recruitment team to find out more.

Morgan Stanley is an equal opportunities employer. We work to provide a supportive and inclusive environment where all individuals can maximize their full potential. Our skilled and creative workforce is comprised of individuals drawn from a broad cross section of the global communities in which we operate and who reflect a variety of backgrounds, talents, perspectives, and experiences. Our strong commitment to a culture of inclusion is evident through our constant focus on recruiting, developing, and advancing individuals based on their skills and talents.