Lead - Application Security SSDLC

Reporting Structure

Reports to Senior
Manager SSDLC

Education

University degree in the field of computer science or IT.

Experience/ Qualifications

6+ years of
Information Security background is essential.

4+ years of Software Development Lifecycle, Security reviews in
project lifecycle

Experience in evaluating the control environment through Architecture,
Software Design reviews and or not limited to Threat Modelling.

Security reviews of design flaws

Hands on experience in Static Application Security Testing and Dynamic
Application Security Testing.

Experience in standardizing application security tools and methodology

Should be familiar with the best practices of OWASP, SANS Institute,
ISACA, GAO, FISCAM, NSA, NIST, Internet Engineering Task Force (IETF)

Develop a detailed security framework to be followed by developers in
every steps of software development lifecycle.

Experience in
software/application analysis tools like SAST, DAST, SCA, IAST, RASP, threat modelling, etc.

Industry

Information technology

Responsibilities

Conduct internal /
third-party Security (SSDLC) Risk Assessments on business-critical assets and processes.

Coordinate with project teams for ensuring security framework to enforced
in all phases of SSDLC

Prepare security effectiveness reports for management.

Testing the
applications / systems for SSDLC framework to RBI / ReBIT Information Security practices

Ensure new
applications are inducted into Data centre after conducting SSDLC assessments

Follow up on closure of these gaps and escalate when necessary

Define and enhance application security requirements and standards
which must be designed for agile development methods leveraging traditional application architectures

Assist DevSecOPs
team to create secure predictable CI/CD pipeline processes, and enable application teams to develop new capabilities securely

Certifications (any two)

• CISSP


• CSSLP


• Certificates related
  to cloud security


• Certificates related
  to DevSecOps automation