Application Security Engineer (DevSecOps)

About the role

IQVIA is looking for an Application Security / DevSecOps Specialist to support and scale its global Application Security and DevSecOps capabilities. The role sits within the global Information Security organization and works with Security Architecture, Cloud Security, Vulnerability Management and DevOps platform teams, as well as product engineering and delivery teams. It suits a technically strong practitioner who builds, automates and drives adoption of secure-by-design practices.

Key responsibilities

• Drive adoption of CI/CD security controls, including tooling configuration, findings triage, pipeline onboarding and remediation follow-through.
• Support CI/CD security requests and onboarding to DevSecOps services.
• Support application security assessments and design reviews, helping teams identify risks, define mitigations and track remediation.
• Act as a security point of contact for developers, advising on secure coding, SDLC requirements and secure architecture patterns.
• Review application architectures (cloud-native, microservices, APIs, containers, event-driven systems) and support deployments on Microsoft Azure and Amazon AWS.
• Contribute to DevSecOps practices such as SAST, DAST, SCA, container scanning, secret detection and IaC security.
• Build and maintain Python scripts and automations for security checks, reporting and CI/CD integration.
• Support AI security for development, covering model risk, training pipeline protection, LLM prompt workflows and data leakage.
• Help define security standards and promote Security by Design and Shift-Left.

Required profile

• Minimum 6-8 years of experience in application security, DevSecOps, software or cloud engineering.
• Bachelor's degree in Computer Science, Software Engineering, Information Security or equivalent practical experience preferred.
• Security or cloud certifications (e.g., CSSLP, AWS/Azure Security, CKAD/CKS) preferred but not mandatory.
• Strong communication skills and the ability to explain security concepts to engineering teams.

Required skills

• CI/CD pipelines and DevSecOps tooling; SAST, DAST, SCA, container scanning and IaC security.
• Azure and/or AWS, including IaaS and PaaS.
• Kubernetes, microservices, APIs and event-driven systems.
• Python scripting; OWASP Top 10 and secure coding principles.
• Basic to intermediate knowledge of AI/ML security; NIST, OWASP, ISO 27001 knowledge is an advantage.