TG IT Application Security Manager

We need to output HTML fragment with sections: About the role? The posting includes a job summary and description. We need to use

for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include sections only when posting has real specific content. We have content for responsibilities (Essential Duties), qualifications (Minimum Qualification Requirements includes Education, Experience, Certificates, etc.), maybe Skills (Korn Ferry Competencies, KPIs). Benefits: there is a paragraph about benefits after "At Terumo Blood and Cell Technologies, we provide competitive total reward offerings...". Pay: there is Target Pay Range and Target Bonus on Base. Schedule: not mentioned (Work Arrangement: Hybrid, but schedule not specified). We could include Schedule if we have info: Work Arrangement: Hybrid maybe considered schedule? But schedule typically refers to full-time/part-time, shift. We have Employment Type: Full-time. Could put Schedule under maybe not needed. The instruction: never create Pay/Schedule/Benefits sections unless posting actually states them. We have Pay stated (Target Pay Range). Benefits stated. Schedule? Not explicit schedule like hours; we have Work Arrangement: Hybrid, Employment Type: Full-time. Could consider that as schedule? Might be okay to include Schedule section with Hybrid and Full-time? But they said schedule: maybe they expect something like work schedule (e.g., Monday-Friday). Not present. Safer to omit Schedule section. We must not repeat job title as heading. No Job ID/requisition numbers as headings. We can include minor metadata in short p or drop it. We'll include a short p for Requisition ID maybe? But they said do NOT put Job ID/requisition numbers as headings — fold minor metadata into a short

or drop it. So we can include a

with Requisition ID: 35487 maybe. We need to preserve all substantive information; do not invent or summarize away detail. Must not omit details. We need to include all duties, qualifications, etc. Use

• for any list of duties/requirements/benefits. Use

  for prose. We need to decide sections: About the role (maybe job summary). Responsibilities (Essential Duties). Requirements (maybe Minimum Qualification Requirements). Qualifications (maybe Certificates, Korn Ferry Competencies, KPIs). Skills (maybe combine with Qualifications? But we need to avoid thin sections. Could combine Requirements and Qualifications into one? But they said prefer a few substantive sections over many thin ones. We could have sections: About the role, Responsibilities, Qualifications (including education, experience, certs, competencies, KPIs), Benefits, Pay. That's 5 sections. We must ensure each heading has substantive content. Let's extract content. Job Summary paragraph: "Enterprise Application Portfolio - The Application Security Manager is responsible for leading the organization's Application Security program, ensuring that security is integrated throughout the Application Cycle (SDLC). This role partners closely with the software teams, cloud, architecture, infrastructure, and potentially product teams to identify, assess, and mitigate application security risks while enabling secure software delivery. The successful candidate will lead a team of application security analysts, establish secure development standards, oversee security testing programs, and drive adoption of security best practices aligned with industry standards such as NIST SP 800-218 (Secure Software Development Framework), NIST Cybersecurity Framework (CSF) 2.0, OWASP, and CIS Controls." That's About the role. Responsibilities: list of duties under ESSENTIAL DUTIES (or Key Responsibilities). We need to capture each bullet. The text includes many paragraphs with bold headings like Application Security Leadership, Secure Software Lifecycle, Security Testing, etc. We need to turn each duty into list items. We must preserve all substantive information; not summarize away detail. So we need to list each duty as separate

• . Could group under headings? But we only allowed
  • for any list. We could have nested lists? Probably fine to have flat list of duties. We'll extract each duty sentence. Let's parse: Application Security Leadership - Collaborate with other global and regional leaders within to develop the enterprise Application Security strategy. - Lead, mentor, and develop Application Security Analysts. - Define AppSec metrics, KPIs, and maturity goals in collaboration with regional and global security leaders. Secure Software Lifecycle - Integrate security into all phases of the enterprise application portfolio. - Ensure security requirements are incorporated during design and architecture reviews. - Promote security-by-design principles across application teams. Security Testing - Manage and oversee: Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Interactive Application Security Testing (IAST), API Security Testing, Container Security, Infrastructure as Code (IaC) Security, Mobile Application Security Testing, Secrets Detection - Review findings, prioritize remediation, and validate fixes. - Assist in Supply Chain Security Threat Modeling - Facilitate threat modeling sessions with development teams. - Identify abuse cases and attack paths. - Recommend architectural improvements. - Ensure high-risk applications undergo formal security architecture reviews. Vulnerability Management - Establish application vulnerability management processes - Prioritize remediation using risk-based methodologies - Track remediation SLAs - Report vulnerability metrics to executive leadership - Coordinate penetration testing remediation activities Threat Intelligence (maybe missing heading but appears after Vulnerability Management? Actually text: "Threat Intelligence Cloud Application Security Support secure development within cloud platforms including: AWS Microsoft Azure Google Cloud Platform". Might be two headings: Threat Intelligence and Cloud Application Security. We'll treat as separate. Cloud Application Security - Support secure development within cloud platforms including: AWS, Microsoft Azure, Google Cloud Platform Secure Code Reviews - Conduct manual secure code reviews - Review high-risk applications - Provide secure coding guidance - Coach development teams on remediation API Security - Establish and set-up safe rules - Find weak spots through testing - Monitor logs to spot shadow APIs and strange traffic patterns Security Awareness - Collaboration on training programs covering: OWASP Top 10, Secure Coding, API Security, Cloud Security, Common software vulnerabilities, Secure design principles Application Risk Management - Perform application security risk assessments. - Support enterprise application risk management initiatives. Incident Response - Support cyber incident response by: Investigating application security incidents. - Supporting forensic analysis. - Identifying root causes. - Leading post-incident reviews. - Developing preventive controls. Compliance - Support compliance initiatives including: NIST CSF 2.0, NIST SP 800-218 (SSDF), NIST SP 800-53, OWASP ASVS, PCI DSS, HIPAA, SOX, ISO/IEC 27001, SOC 2 Other Duties And Responsibilities (maybe nothing else). We'll ignore. Now Requirements: Minimum Qualification Requirements includes Education, Experience, Certificates, Licenses, Registrations, Korn Ferry Competencies, KPIs, Physical Requirements (US Only). We'll treat as Qualifications section. We need to preserve all details: Education: Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field. Master's degree preferred. Experience: 8–10+ years of cybersecurity experience. 5+ years in Application Security. 3+ years leading security teams. Experience implementing enterprise DevSecOps programs. Experience working with Agile and CI/CD environments. Experience with cloud-native application security. -Or- An equivalent competency level acquired through a variation of these qualifications may be considered. Certificates, Licenses, Registrations: list: CISSP, CSSLP, GIAC Web Application Penetration Tester (GWAPT), GIAC Secure Software Programmer (GSSP), Certified Cloud Security Professional (CCSP), Certified Information Security Manager (CISM), Microsoft Certified: Cybersecurity Architect Expert, Microsoft Certified: Azure Security Engineer Associate Korn Ferry Competencies: Leadership Competencies: Strong people leadership, Strategic planning, Executive communication, Stakeholder management, Cross-functional collaboration, Risk-based decision making, Program management, Coaching and mentoring, Conflict resolution, Continuous improvement mindset Key Performance Indicators (KPIs): list many. Physical Requirements (for US Only): Typical Office Environment requirements include: reading, speaking, hearing, close vision, traverse, bending, sitting, and occasional lifting up to 20 pounds. We could include Physical Requirements under Qualifications or maybe separate but we have limited sections. Could add a section "Requirements" for education/experience, and "Qualifications" for certs/competencies/KPIs/physical. But we need to avoid thin sections. Might combine all into one "Qualifications" section with subheadings? But we only allowed

    for section headings; we cannot have subheadings other than

    . Could we use

    with bold? Not allowed? The instruction: use

    for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid other headings, but we should follow that pattern. Could we have multiple

    sections each representing a category. We could have sections: About the role, Responsibilities, Qualifications (including education/experience/certs/competencies/KPIs/physical). Benefits, Pay. That's 4 sections. We need to ensure we don't create thin sections. Qualifications will be substantive. Now Benefits: paragraph after "At Terumo Blood and Cell Technologies, we provide competitive total reward offerings..." includes multiple group medical, dental and vision plans, robust wellness program, life insurance and disability coverages, voluntary programs such as group accident, hospital indemnity, critical illness, pet insurance, 401(k) plan with matching contribution, vacation and sick time programs. We'll capture as list. Pay: Target Pay Range: $121,400.00 to $151,800.00 - Salary to be determined by the education, experience, knowledge, skills, and abilities of the applicant, internal equity, and alignment with market data Target Bonus on Base: 15.0 We'll output as

    maybe with details. Now we need to exclude boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. At end there is EEO statement; we must remove. Also "We anticipate this requisition will be open for a minimum of five days, from 09/16/2026. We encourage your prompt application." That's application instructions; remove. Also "At Terumo Blood and Cell Technologies, we provide competitive total reward offerings..." is benefits; keep. Now produce HTML fragment. We'll start with a

    for Requisition ID maybe. Then

    About the role

    ... job summary ...

    Then

    Responsibilities

    with many
    • . Then

      Qualifications

      we need to include subpoints maybe as

      paragraphs or

      . Since it's a list of items, we can use
      • for each bullet category? But we have many details; we could use

        for paragraphs and

        for lists inside. The instruction: Use
        • for any list of duties/requirements/benefits, and

          for prose. So for qualifications we have lists (education, experience, certificates, competencies, KPIs, physical requirements). We'll treat each as a list. We'll structure:

          Qualifications

          Education: ...

          maybe not list. But education is a single line; could be

          . Experience is a list; we can

          . Certificates list; Korn Ferry Competencies list; KPIs list; Physical Requirements list. We'll do:

          Education: Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field. Master