Overview Recruiter
- Lorena Padilla Position reports to:Venkatesh Nadagana Work schedule: Hybrid, going to the office in GDL for 3 days THE ROLE: The Senior Application Security Engineer (AppSec) implements and validates security controls across Herbalife's general applications while supporting Application Security and DevSecOps initiatives. This role integrates security throughout the Software Development Lifecycle (SDLC) and establishes and maintains application security standards, policies, and best practices. The position performs security assessments, reviews, and risk analyses to identify and mitigate vulnerabilities and ensure security controls are effectively implemented across all phases of development. The role collaborates closely with development and engineering teams to drive secure development practices, strengthen application resilience, and reduce security risks. Additionally, it drives continuous improvement initiatives and applies structured root-cause analysis to implement effective, scalable, and long-term security solutions that enhance the organization's overall security posture. HOW YOU WOULD CONTRIBUTE:
• Own planning and execution of regional AppSec activities for the region
• Maintain visibility into regional application security posture and identified gaps
• Drive alignment of the region practices with established global standards
• Act as the primary AppSec point of contact for the region for BAU and project activities within defined AppSec standards
• Engage with regional stakeholders to understand requirements, plan security activities, and guide engineers
• Escalate and align with leadership for exceptions or deviations from standard practices
• Managing the day-to-day activities related to application security management system and the application security pipeline including vulnerability management, code review, etc.
• Define the Corporate Cybersecurity Strategic program and evaluate compliance of the program and its implementation against best practices and frameworks such as OWASP and OSSAM.
• Integrating security tools, standards,



and processes into the Software development life cycle and Cloud Secure development.
• Ensuring that application teams and QA personnel are trained with the appropriate level of security knowledge to perform their daily activities.
• Improving and supporting application security tool deployments including static, dynamic, interactive, secret, runtime testing and SCA tools.
• Work with manager to improve and maintain secure development standards.
• Supporting the incident response and architecture review processes whenever application security expertise is needed.
• Managing annual penetration testing services, including both expert consulting and managed services.
• Work with manager to define and enforce the vulnerability management process which must include vulnerability assessment and pen tests as well as a continuous improvement process.
• Support manager to finish application security projects.
• Supporting Vendor Security activities to ensure 3rd‐party software and development meets Herbalife security standards.
• Vulnerability Management: Identifying and mitigating vulnerabilities in IoT systems. This involves conducting regular security assessments and applying patches. For instance, performing vulnerability scans on industrial IoT and PCI DSS systems to detect and fix security flaws. WHAT’S SPECIAL ABOUT THE TEAM:The Application Security team operates in a highly collaborative and structured environment. The team is responsible for developing and implementing strategies to protect organizational applications, which includes Web, Desktop, API, Web Services and Mobile applications, leading projects, and supporting incidents.



Here are some key aspects of the team dynamic and environment: 1-Collaborate with other departments in their daily security requirements. 2-Close interaction with Herbalife’s Development teams for guidance on proper application security best practices and standards 3-Support internal and external contractual, regulatory, and legal Herbalife’s requirements compliance relevant to application security 4-24x7 availability for incident response and end of month support 5-Respond immediately to application security-related incidents and do post-event analysis6-Review not a problem vulnerabilities 7-Supply chain implementation8-Key management process implementation and optimization.9-Audit of pipelines for application security tools compliance.10-Scripts automation for vulns reporting. Job Qualifications SKILLS AND BACKGROUND REQUIRED TO BE SUCCESSFUL:
• 3-5 year of experience as an Application Security Engineer (Must)
• DEVSECOPS, DEVOPS with security experience or APPSEC and Applications Pentesting. (Must)
• OWASP certification or a related certification is required. (Must)
• At least 3 to 4 years of experience as a developer
• At least 2 years of penetration experience for web applications, mobile apps, WeChat mini program etc. (Must)
• Related experience in the Application Cybersecurity, IT Security field and application development operations.
• Embedded Application information management systems into application development lifecycle
• Experience with Application security protection and testing tools such as DAST, IAST, SAST, MAST, RASP, WAF
• Familiar with one of programming language and development tools in in either of the following technology stacks:
• JAVA related development skills, framework, e.g., Java Spring MVC, Spring Cloud...
• Windows Development API's including C#, .
NET framework, .
NET Core Education
• Bachelor’s degree in Computer Science or related field. Preferred Certifications
• AZ-500
• AZ-900
• CompTIA Security+
• OSCP
• CISSP
• CSWAE

📌 Sr Engineer, Application Security (México)
🏢 Herbalife
📍 México