Application Security Architect

Bucharest Metropolitan AreaPosted 1 month agoWebsite

Apply on SCOR's site →

At a Glance

AWSAzureGCPCI/CDOWASPThreat Modeling

Full details on LinkedIn

The complete job description, requirements, and application details are available on the original posting.

About SCOR

SCOR SE is a leading global reinsurance company based in Paris, France. Established in 1970, it operates as an independent Tier 1 reinsurer, serving over 5,200 clients across approximately 30 countries. The company is organized into three main divisions: SCOR Global P&C, SCOR Global L&H, and SCOR Global Investments, providing a wide range of reinsurance solutions in property and casualty, life and health, and asset management. SCOR Global P&C offers reinsurance products for non-life risks, including property, motor, casualty, and specialized lines such as aviation and cyber liability. SCOR Global L&H focuses on life reinsurance, covering mortality, morbidity, and longevity risks, along with financial solutions for insurers. The asset management division enhances the company's financial strategy by managing investment portfolios. With a strong emphasis on effective risk management and profitability, SCOR SE is recognized for its expertise in complex risk areas and its robust global network.

Employees

3,700

124 engineers

Revenue

$17B

Website

Visit →

Security at SCOR

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

Security Philosophy

Section 1 — AppSec Philosophy & Stated Priorities Stated mission: SCOR publicly frames information security around protecting digital assets, strengthening resilience, enabling innovation, and building trust.
It identifies safeguarding information as a strategic priority and applies confidentiality, integrity, availability, and safety principles.
Developer enablement versus gatekeeping: The AppSec Architect role requires collaboration with development and IT teams, embedding security into the SDLC from the beginning, and acting as a trusted advisor rather than only a reviewer or auditor.
The same role also requires defining and enforcing secure-coding practices, security gates, security requirements, and configuration standards.
Risk philosophy: SCOR documents a risk-based vulnerability and patch-management program using CVSS and NVD scoring, remediation planning, time-to-remediate benchmarks, automated tracking, continuous monitoring, threat intelligence, threat hunting, and a centralized threat catalog.
Stated goals and pain points: Public materials identify continuous reduction of vulnerability exposure, stronger application-security posture, remediation of audit findings, automated and auditable reporting, improved control monitoring, security-maturity dashboards, and continuous improvement as operating goals.
Gaps and contradictions: No public SCOR statement was found describing scanner-noise reduction, false-positive reduction, a developer security-champions model, or a named AppSec mission separate from the broader Group Information Security mission.
The public operating model combines developer enablement with enforceable controls and gates.
No contradiction between those stated positions was identified. ⚠️ Staleness: The public Information Security Policy is marked Public Version — January 2026, older than eight months at the requested research date.

Security Team

Section 2 — The AppSec Team: People & Structure Org structure and reporting: SCOR’s Group Information Security function is led by the CISO.
Security governance is integrated with IT governance and risk management through the Information Security Steering Committee, Operational Risk Committee, and Security Forums. A 24/7 Security Operations Center is also documented.
Key public-facing leaders: • Shadi Kenan — Chief Information Security Officer.
His public profile describes global security strategy, security transformation, multidisciplinary teams, vulnerability management, cloud, and regulatory alignment.
A separate profile record lists his SCOR CISO experience as ending in July 2025.
Current-status evidence is contradictory. • Michaël Bydlon — Network & Operational Security Manager.
His public profile describes global security operations, security architecture, SOC incident response, vendor coordination, and team management. • Don Bolz — AVP Information Security Manager - Americas.
His public profile describes regional security governance, IT-risk mapping, incident coordination, security-tool selection, and a global cyber-awareness program.
Public professional profiles do not provide a reliable AppSec-specific headcount or defensible range.
Active AppSec job postings as of: 1 explicitly AppSec posting — Application Security Architect, job 5236, posted.
Additional active security-related postings covered reporting automation, operations security, and network security but were not counted as AppSec.
Common skill and tool patterns: secure-SDLC integration.
OWASP-aligned practices.
Threat modeling.
Architecture reviews.
SAST, DAST, SCA, and dependency scanning.
Cloud and hybrid security.
Vulnerability remediation.
Metrics and dashboards.
Defender for Cloud.
Microsoft Sentinel.
Python or PowerShell.
Gaps and contradictions: No public AppSec headcount, formal AppSec reporting line, or complete team roster was found.
Shadi Kenan’s public current-title presentation conflicts with an experience record ending in July 2025.

Key Initiatives

Section 3 — AppSec Initiatives & Workflows Security champions program: No Evidence Found.
SCOR’s public security and careers materials document training, security forums, development-team collaboration, and role-based education, but do not identify a security-champions program, champion responsibilities, or champion coverage.
Shift left in practice: The Application Security Architect role requires embedding security into the SDLC and CI/CD pipelines, secure-coding practices, security gates, threat modeling, architecture reviews, SAST, DAST, SCA, and dependency scanning.
Vulnerability-management intake: SCOR documents continuous monitoring, security assessments, regular vulnerability scanning, CVE-content updates, independent penetration testing, red-team exercises, audit findings, and reported vulnerabilities or incidents.
Threat-intelligence feeds and CERT alerts are also documented.
Triage and remediation: The documented workflow uses CVSS and NVD scoring, risk-informed remediation planning, time-to-remediate benchmarks, automated tracking, prioritization, audit-remediation support, escalation, and monitoring of vulnerability-remediation time.
Secure-SDLC artifacts and ceremonies: Public evidence names security architecture standards, application-security requirements, secure-coding standards, OWASP SAMM and ASVS alignment, threat modeling, architecture reviews, security gates, security configurations, CI/CD integration, audit-remediation plans, metrics, and dashboards.
Operational security workflow: Operations Security roles coordinate with service owners, implement controls across infrastructure, cloud, endpoints, applications, and networks, manage certificates and secrets, support incident response, aggregate KPIs, maintain centralized dashboards, and assist with executive reporting.
Recent initiatives within the last six months: SCOR posted an Application Security Architect role and a Security Reporting & Automation Analyst role on.
The former covers secure-SDLC and AppSec architecture.
The latter covers automated security-governance reporting, control monitoring, APIs, Python, Power BI, and Power Automate.
Gaps and contradictions: No public AppSec SLA by severity, ticket-ownership model, bug-bounty intake, security-champion program, or named CI/CD scanning product was found.
The policy provides remediation benchmarks and automated tracking but does not publish the benchmark values.

Preparing for an AppSec interview?

Get the weekly briefing 2,000+ security pros trust.

Interested in this role?

Apply on SCOR's site