The Client

An international e-commerce company operating in an omnichannel model (own web platform, mobile application, integrations with marketplaces), serving several million users monthly. The organization developed its product in an agile model with multiple parallel development teams and a complex cloud-based CI/CD environment.

The challenge

The rapid pace of product development meant that application security was handled reactively. Security testing was performed irregularly, and responsibility for secure coding was distributed across development teams.

Identified risks included:

• lack of a formal threat modeling process during the feature design stage,
• vulnerabilities detected only after deployment to production,
• inconsistent use of SAST/DAST tools and open-source dependency management,
• increasing compliance requirements (PCI DSS, personal data protection).

The company needed an experienced Application Security expert but was not prepared for a long recruitment process for a permanent role.

The solution

The company needed an experienced Application Security expert but was not prepared for a long recruitment process for a permanent role.

The expert’s profile included:

• over 7 years of experience in application security,
• hands-on experience in secure SDLC, threat modeling, and code review,
• knowledge of tools such as BlackDuck, Nexus IQ, OWASP ZAP, Fortify, and SonarQube,
• experience with DevSecOps (CI/CD, Docker, Kubernetes),
• practical application of OWASP and NIST standards.

Scope of activities in the project included:

• integrating security into the entire software development lifecycle (shift-left approach),
• implementing and standardizing SAST, DAST, and dependency scanning processes,
• conducting threat modeling workshops for product teams,
• supporting analysis and response to application security incidents,
• developing secure coding guidelines and providing developer training,
• organizing compliance requirements related to web and mobile applications.

The expert acted as a bridge between development, DevOps, and security teams, helping to build a security-first culture without slowing down the product roadmap.

The conclusions

• 45% reduction in critical vulnerabilities detected at the production stage.
• 40% reduction in vulnerability remediation time (MTTR).
• Implementation of a formal threat modeling process for all new features.
• A structured and measurable DevSecOps process integrated with the CI/CD pipeline.

The client strengthened application security without creating a separate AppSec department, reduced the risk of incidents, and increased organizational maturity in secure software development.