Application Security Engineer

About the client:

Our Client is a global technology company, home to more than 220,000 people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud and AI, powered by a broad portfolio of technology services and products. We work with clients across all major verticals, providing industry solutions for Financial Services, Manufacturing, Life Sciences and Healthcare, Technology and Services, Telecom and Media, Retail and CPG, and Public Services.

Experience: 6-12 years

Mode of working: Hybrid (3 Days from Office)

Location: Bengaluru / Noida / Pune

Roles and Responsibilities:

• Lead and Manage Secure Design review and Thread modelling for Applications ( On premise and SaaS based Applications)
• Develop and implement comprehensive security strategies to safeguard application systems.
• Define security best practices and standards and Lead Secure Software Development Lifecycle best practices and standards.
• Oversee security incident response and mitigation efforts, ensuring quick and efficient handling of security breaches or threats.
• Conduct regular penetration testing, Red team exercise, security assessments and audits to identify vulnerabilities and implement corrective measures.
• Collaborate with application stakeholders to develop security roadmaps and participate in daily stand-ups to align security initiatives with organizational goals.
• Foster a culture of continuous improvement in Application security including Development,Supply chain security and AI/ML
• Experience in managing Business Continuity and Crisis management
• Staying up-to-date on the latest Application security technologies, trends, and best practices.
• A strong understanding of cloud computing technologies, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).
• Knowledge of security frameworks such as SANS,OWASP, NIST and ISO Framework.
• Certifications such as Certified Secure Software Lifecycle Professional (CSSLP), Certified Information Systems Security Professional (CISSP), or Certified Cloud Architect (CCA) are preferred.
• Extensive knowledge and experience with developing Cloud Security Frameworks using industry best practices such as those from the Cloud Security Alliance (CSA) and NIST CSF and regulatory requirements such as HIPAA, HITrust and PCI or closely related.
• Understanding of industry regulatory and compliance requirements (i.e., FedRAMP, PCI-DSS, NIST, HIPAA) and skilled at interpreting the compliance and security requirements into implementable and repeatable controls

Skills and Qualifications:

• Threat Modelling - STRIDE
• Proficiency in reading, writing, and auditing code and the ability to learn new languages/technologies including but not limited to - C#,.Net,.Net Core, Python,NodeJS,Javascript,VueJS.
• Experience with OWASP Top10 or SANS Top 25
• Knowledge of OAuth 2.0/OpenID Connect/ Cryptography
• Knowledge of Responsible AI and ML Security.
• Knowledge of Supply chain, Secure build and Container platform security.
• Knowledge of Pen Testing and Vulnerability assessment platform
• Knowledge of SAST/DAST/Open Source/Code quality/Code Smell management tools
• AWS,Azure and GCP Native Security service awareness