239 Sast Jobs - Page 9

Job Statement: NopalCyber makes cybersecurity manageable, affordable, reliable, and powerful for companies that need to be resilient and compliant. Managed extended detection and response (MXDR), attack surface management (ASM), breach and attack simulation (BAS), and advisory services fortify your cybersecurity across both offense and defense. AI-driven intelligence in our Nopal360 platform, our NopalGo mobile app, and our proprietary Cyber Intelligence Quotient (CIQ) lets anyone quantify, track, and visualize their cybersecurity posture in real-time. Our service packages, which are each tailored to a clients needs and budget, and external threat analysis, which provides critical intelligence at no-cost, help to democratize cybersecurity by making enterprise-grade defenses and security operations available to organizations of all sizes. NopalCyber lowers the barrier to entry while raising the bar for security and service. We are looking for a proven, high energy, results oriented GRC professional, where you will be a key advisor for our clients, analyzing business requirements to design and implement ideal security solutions for their needs. As an established GRC Professional, you will span operational, tactical, and strategic levels as well as tasks that tackle difficult problems that businesses are facing when building out and improving their security and compliance posture For attending the walk-in, please fill the form https://forms.gle/wLS8HtPyFZQKA4jf8 (Copy and paste in a browser) 1. SOC L3 Experience: 6+ years Skills: SIEM, IDS/IPS, EDR tools, log/packet analysis, TCP/IP, Linux/Windows, threat intelligence Tools: Splunk, QRadar, Crowdstrike, NetWitness Certifications (preferred): CISSP, CEH, CISM, GCIH 2. Offensive Security Specialist / Penetration Tester-L3 Experience: 6+ Skills: Web/API/Mobile Pentesting, Threat Modeling, Code Review, DAST, Cloud & Microservices security Tools: Burp Suite, Metasploit, Cobalt Strike, Nmap Languages: Python, Go, Java, JavaScript, C++ Certifications (preferred): OSCP, OSCE, OSWE, GPEN, CEH 3. GRC Security Consultant-L3 Experience: 8+ years Skills: Risk assessments, audits, ISO/NIST/PCI/GDPR frameworks, GRC tools, TPRM, vendor/client management Certifications: ISO 27001 LA/LI, CISSP, CISA, CIPP, CCSP, CCSK Note: Immediate to 30 days' notice preferred.

Will be working on Application security testing Skills. Strategize and plan static and dynamic application security testing (SAST/DAST / SCA) tools. Will be responsible for Secure Coding Practices Required education Bachelor's Degree Preferred education Master's Degree Required technical and professional expertise BE / B Tech in any stream, M.Sc. (Computer Science/IT) / M.C.A, with Minimum 5 plus years of experience. Application Security TestingExperience with static and dynamic application security testing (SAST/DAST/ SCA) tools. Secure Coding PracticesKnowledge of secure coding standards (e.g., OWASP Top Ten) and experience in reviewing code for security vulnerabilities. Threat ModelingAbility to conduct threat modeling sessions to identify and mitigate security risks Preferred technical and professional experience Vulnerability AssessmentExperience in conducting vulnerability assessments and penetration testing Application Security TestingExperience with static and dynamic application security testing (SAST/DAST) tools Security ToolsProficiency in using security tools like Burp Suite, Nessus, or Fortify

5 - 7 years of experience in a DevSecOps, Application Security, or DevOps Security role. Strong working knowledge of: Extensive experience in GitHub Enterprise and related security capabilities, specially security tool integrations and automations CI/CD pipeline integration of security tooling. Cloud platforms (AWS, Azure, GCP) and hands-on experience with CSPM solutions. Working experience in Application security tools (SAST, DAST, SCA, IaC) Sound working experience in scripting and programming languages Experience collaborating with software engineers, cloud teams, and SREs in a security capacity. Good understanding of OWASP Top 10, secure coding practices, and DevOps lifecycle. Proficient in scripting (e.g., Python, Bash) and automation (e.g., GitHub Actions, Terraform, Ansible).

Senior Cybersecurity Specialist Are you an experienced cybersecurity professional who is excited about practical application of cybersecurity into industrial and IoT environments We would like to have you on our team to keep smart cities cybersecure! The KONE Technology and Innovation (KTI) function is where the magic happens at KONE. It's where we combine the physical world - escalators and elevators - with smart and connected digital systems. We are changing and improving the way billions of people move within cities every day. Within the KONE Technology & Innovation unit, we have a dedicated Cecurity team for assuring the security of KONE's products and solutions as well as applications used by KONE's business lines. Buzzwords: Application security, Cloud security, SDL, DevSecOps We are now looking for a person to support and drive the Security Development Lifecycle (SDL) activities in KONE solution development projects. Our solutions range from connected elevator systems to cloud services and to mobile applications for technicians and for end users. As a Senior Cybersecurity Specialist, you will be responsible for supporting KONE development teams globally to identify and implement security requirements and to review and test the solutions as they have been implemented. You enjoy working in co-operation with development teams to offer solutions for security problems and practical guidelines on how to implement security in the projects. You get to conduct threat analysis and identify the appropriate security requirements. You don't shy away from getting hands on with application owners and developers to guide them or help them implement the necessary security controls. Through validation and testing you ensure that controls are implemented, and the requirements fulfilled. You support our becoming and existing Security Champions to succeed in their roles by guiding, identifying their skill gaps, and providing training. You might be an experienced security-minded software developer, or perhaps you are a cybersecurity professional who has specialized in application security. You can communicate with various audiences, and you can deal both with the big picture as well as with details when so required. The position is located in Pune, India. Responsibilities Act as a cybersecurity advisor and provide security expertise and guidance to development and operations teams. Conduct risk-based security impact assessments to classify applications and assign appropriate security requirements. Translate requirements into actionable tasks and guide stakeholders in understanding and implementing them. Detect security issues during validation and operation using automation and scenario-based testing. Help teams to understand and mitigate risks and vulnerabilities. Review and enhance security documentation and assessments from Security Champions, offering constructive feedback. Monitor R&D and IT stakeholder needs and deliver targeted security training or clinics. Collaborate within the Cybersecurity team to improve KONE's security management system, SDL standards, processes, and tools. Requirements 5+ years of experience in cybersecurity. CISSP, CSSLP or other relevant certifications are considered a plus. Educational qualifications (B. Sc. or M Sc. in computer science, business administration, information technology management, information systems security or related) Practical experience in implementing Security Development Lifecycle (SDL) in agile software projects (for example, Microsoft SDL, OWASP, BSIMM) Familiarity with security standards and best practices (for example: ISO 27001, IEC 62443, OWASP) Experience in threat modeling and security risk assessment Experience with DevSecOps practices and tools (SCA, SAST, DAST) Experience with cloud platforms (AWS or Microsoft Azure) Why to join KONE's cybersecurity team We at KONE's cybersecurity team are at an interesting point currently. Our focus has been on modernizing enterprise cybersecurity to limit risks with day-to-day operations but at the same time, we are building our industrial and product cybersecurity. KONE is on a digitalization journey and our elevators are transforming from a steel box on the end of a rope into central platforms of smart buildings. We are bringing totally new kinds of innovative solutions to the market to enable even smarter people flow. As our offering becomes more digital, excellent cybersecurity plays a crucial role in building customer trust. KONE Technology and Innovation We are changing and improving the way billions of people move within buildings every day. Hardware is where we've always shined, but today, digital expertise - IoT, analytics, AI, automation, simulation, to name a few - is equally important for our continued success. What's KONE Technology & Innovation like as a workplace We like to think of ourselves as a diverse tribe, pulling together to understand and meet the ever-changing needs of our customers, from concept through to design, down to every single finished product. This all happens in an atmosphere of trust and respect, typified by our Nordic values, a healthy work-life balance, and a flat hierarchy. Read more on

Implement security-as-code principles and automate security controls in CI/CD pipelines. Conduct secure code reviews and assist developers in adopting secure coding practices. Deploy and manage security tools such as SAST, DAST, SCA, IAST, and container security solutions.

Happiest Minds Technologies is a Mindful IT Company that focuses on enabling digital transformation for enterprises and technology providers by leveraging disruptive technologies. With a 'Born Digital . Born Agile' approach, we offer digital solutions, infrastructure, product engineering, and security services across various industry sectors. Headquartered in Bangalore, India, Happiest Minds has a global presence in the U.S., UK, Canada, Australia, and the Middle East. Interested professionals can reach out to me ankita.patari@happiestminds.com Experience Details : 7 to 10 Years Location : Bangalore,Pune,Noida,Bhubneswar,Madurai,Coimabatore S kills: Burp suite, Vulnerability Assessment, Static/dynamic testing of mobile applications Job Description: Good written and verbal communication skills Hands on experience in Application security testing: Manual code walkthroughs, using Burp tool, NMap, Radioshark, Checkmarx etc., - Experience in both DAST and SAST - Preparation of detailed testing reports with vulnerabilities with CVSS scoring and remediations - Guiding developers in fixing the vulnerabilities - Knowledge of writing the test cases aligning with OWAP / NIST standards - Knowledge of External PT - Team management - Client management - Tracking and reporting of vulnerabilities - Understanding of Cybersecurity domain Thanks And Regards, Ankita Ghosh

We are looking for a skilled Cyber Testing Senior Associate 1 to join our team in Bengaluru. The ideal candidate will have between 5 and 10 years of experience in cyber testing, with expertise in manual and automated testing. Roles and Responsibility Perform security assessments, including static and dynamic application security testing. Conduct manual penetration testing on web applications, network devices, and other systems. Collaborate with clients in a fast-paced environment across various technology stacks and services. Develop, enhance, and interpret security standards and guidance. Demonstrate and promote security best practices, including secure development and cloud security. Assist with the development of remediation recommendations for identified findings. Identify and clearly articulate (written and verbal) findings to senior management and clients. Help identify improvement opportunities for assigned clients. Stay up-to-date with the latest security trends, technologies, and best practices. Work effectively within a team, fostering collaboration and open communication to deliver successful outcomes. Supervise and provide engagement management for other staff working on assigned engagements. Job Requirements Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent work experience. Expertise in web security, with extensive knowledge of vulnerabilities and the ability to identify and exploit them effectively. Minimum 5 years of experience in code review, application security testing, or web application development. Excellent written and verbal communication skills. Strong scripting skills, such as Python, Ruby, or Perl. Experience with cloud platforms, such as AWS, and knowledge of cloud security best practices. Familiarity with development technologies like Docker, CDK, Terraform, Java, Python, React, GraphQL, Javascript, JSON, REST, etc. Must possess a high degree of integrity and confidentiality, as well as the ability to adhere to both company policies and best practices. Technical background in application development, networking/system administration, security testing, or related fields. Experience with both static application security testing (SAST) and dynamic application security testing (DAST) using various tools and techniques. Preferred but not required: one or more relevant certifications such as Offensive Security Web Assessor (OSWA), Offensive Security Web Expert (OSWE), Offensive Security Certified Professional (OSCP), Burp Suite Certified Practitioner, or AWS Certified Security Specialist. Additional Info The standard work hours for this role are from 3:30 PM to 11:00 PM IST, aligned with client requirements and deliverables.

We're Hiring! I am excited to share some amazing career opportunities at Happiest Minds. Take your Security career to the next level with Happiest Minds, ! Join a dynamic team, where Security Meets Innovation, and grow with us. Be recognized in a Great Place to Work Certified environment ..Interested candidate can share resume to ankita.patari@happiestminds.com Work Location: Belapur, Navi Mumbai Experience: 11-15 Years General Shift who can join with 30 days notice period Skills: Vulnerability Assessment, Manual Penetration Testing using OWASP checklists, Penetration Testing, OWASP Top 10,OWASP ZAP, Ethical Hacking, Static/dynamic testing of mobile applications, Vulnerability Mitigation Job Description: Project Management - Lead and manage the AppSec team consisting of L1 and L2 resources. Serve as the primary point of contact between the Bank and the team for all project-related activities. Monitor daily operations, ensure resource optimization, and address any issues that arise during the engagement. Application & Security Review - Oversee the review of application security including web, mobile, API, and other banking applications. Perform comprehensive reviews of Network Architecture, Source Code, VAPT reports, and configuration audits. Review deliverables from L1 and L2 resources, ensuring completeness and quality. Compliance and Risk Management Reporting Stakeholder Management B.Sc (IT/CS) / B.Tech in Computer Science, Information Technology, or related field. CISSP, CISA, CISM, CRISC 11-15 years of experience in Application Security, Network Security, and IT Risk & Compliance, with hands-on expertise in security assessments, process audits, and application reviews. Experience in BFSI is preferred. Thanks And Regards, Ankita Ghosh ankita.patari@happiestminds.com

Responsibilities: Bring a deep background and broad experience in Information Security, Application Security, & Application Development or related business areas. Lead a team of high performing individuals who create remediation plans, perform security reviews, and recommend security solutions to meet current and future needs for HMH products and applications. Drive the development and implementation of product and application standard security review processes that result in effective methods for reducing security risks before product releases. Demonstrate an ability to influence all project and portfolio stakeholders; communicate relevant security information to both executive leaders and individual contributors in an effective manner. Accountable for all aspects of staff management, hiring, coaching, training, performance reviews and recommending pay actions and promotions for the Security Engineering team Provide input into the Information Security strategy to ensure that future security investments are aligned appropriately when considering key priorities such as business requirements, industry threat landscape, and risk appetite of HMH. Collaborate closely with the Architecture teams Demonstrated experience handling the demand/supply of project and program resources and tracking allocation. Track policy exceptions and remediation dates through active engagement with development teams and operations teams. Partner with Audit teams to periodically audit controls and secure coding practices being followed by development teams. Staying abreast of latest cyber security threats both internal and external Oversee projects, program delivery, daily monitoring, response; review of cloud infrastructure, physical infrastructure, and the full life cycle of alerts through incident response; and the threat landscape to ensure ongoing and continued maturity of the organization's security controls in addition to service support Drive operational efficiency and excellence leveraging tools, process and automation with appropriate and transparency visibility and metrics that can meet SLAs/SLOs Support and implement controls and visibility to meet third party attestations (SOC2, ISO27001, GDPR, SOX) Balance being collaborative, open, and approachable while still being firm on security policies and in facilitating progress and compromise What you should have: 5 to 6+ years hands-on experience in application security utilizing SAST, DAST, IAST, RASP and WAF. 5+ years of application engineering, architecture or development management experience Proficient analyzing ambiguous problems, compelling communicator with the ability to receive and analyze information, translating security risk to business risk to driving actionable decisions across multiple levels and departments Experience in leading application security remediation work, leading the mitigation initiative to accommodate the developer community priority. Proficient experience with common web application attack vectors and related mitigation strategies that translate to controls within the organization You are highly organized. With many people doing many things in a fast-moving company, strong organizational skillsboth for yourself and for the teamwill be required

Required skillset: Ability to handle security testing projects: Customer Interactions, Team monitoring. Able to derive security requirements Threat Model, TARA, SCA, SAST Able to drive the security standards in the applications like OWASP, SANS, CVSS, CWE, STRIDE, DREAD Good Technical Presentation skills, Team collaboration skills, training and mentoring must be preferred. Expertise in Tools like : Appscan, Fortify, Burpsuite, Kali Linux, Postman Expertise in REST API Penetration testing Handson experience in Embedded Device Security Testing with expertise in Secure Boot, Firmware Analysis, CAN/UDS/USB/JTAG interface security testing Expertise in implementing and executing the Cyber Security Solutions and Penetration Testing for Network and Embedded devices. Hands-on Experience in AWS/Azure Good Technical Presentation skills and Team collaboration skills must be preferred. Security Certifications like CEH, ECSA or equivalent. Role & responsibilities Preferred candidate profile

The Oracle Cloud Infrastructure (OCI) team can provide you the opportunity to build and operate a suite of massive scale, integrated cloud services in a broadly distributed, multi-tenant cloud environment. OCI is committed to providing the best in cloud products that meet the needs of our customers who are tackling some of the world's biggest challenges. We offer unique opportunities for smart, hands-on engineers with the expertise and passion to solve difficult problems in distributed highly available services and virtualized infrastructure. At every level, our engineers have a significant technical and business impact designing and building innovative new systems to power our customer's business critical applications. What is Security Products Group at OCI OCI Security Products Group is building comprehensive product portfolios to protect customers cloud environments with innovative approaches and hyperscale efficiency. Our core security pillars are: customer isolation, data encryption, security controls, visibility. Our vision is to build the most secure cloud environment for our customers to build their applications confidently on top of OCI. We are making strategic decision to heavily invest on detecting system vulnerabilities and threat activities, correlate and analyze problems, then remediate, notify and block attacks from malicious actors against customer cloud environment. We offer a rich set of services to help our customer to secure their data, flexible access to their environment, detect the vulnerabilities and treats in their environment, source code, applications and containers, take remediations to protect customers based on the industry best practice such as CVE and CIS. Our solutions will ensure customers confidently build their business in Oracle Cloud. Career Level - IC5 Who are we looking for We are looking for engineers with distributed systems experience. You should have experience with the design of major features and launching them into production. You've operated high-scale services and understand how to make them more resilient. You work on most projects and tasks independently. You have experience working with services that require data to travel long distances, but have to abide by compliance and regulations. The ideal candidate will own the software design and development for major components of Oracle's Cloud Infrastructure. You should be both a rock-solid coder and a distributed systems generalist, able to dive deep into any part of the stack and low-level systems, as well as design broad distributed system interactions. You should value simplicity and scale, work comfortably in a collaborative, agile environment, and be excited to learn. What are the biggest challenges for the team The biggest challenges for the team are reliability, performance and keep up in cybersecurity space. The dynamic and fast growth of the business is driving us to improve the ability of our systems to scale out and handle traffic patterns with full coverage that are several orders of magnitude greater than what we can support today. We understand that software is living and needs investment. The challenge is making the right tradeoffs, communicating those decisions effectively, and crisp execution. We need engineers who can build services that can reliably protect our customer cloud environment. We need engineers who can figure out how we can keep up our solution in a fast pace to securely protect our customers. We need engineers who can build services that enable us to offer even more options to customers and contribute to the overall growth of Oracle Cloud. Required Qualifications 10+ years distributed service engineering experience in a software development environment Experience driving feature design reviews, documentation, UX reviews, and working with Product Managers through the entire launch process Strong development experience in Java, C++, C#, or similar OO languages Strong knowledge of data structures, algorithms, operating systems, and distributed systems fundamentals Working familiarity with networking protocols (TCP/IP, HTTP) and standard network architectures Good understanding of databases, NoSQL systems, storage and distributed persistence technologies Experience building multi-tenant, virtualized infrastructure a strong plus Preferred Qualifications Hands-on experience developing services on a public cloud platform (e.g., AWS, Azure, Oracle) Building continuous integration/deployment pipelines with robust testing and deployment schedules Expertise in applying threat modeling or other risk identification techniques to develop security solutions Experience and understanding of Cryptography, DDoS, CVE, CIS, SAST, DAST, or similar security and compliance knowledge Career Level - IC5

Will be working on Application security testing Skills. Strategize and plan static and dynamic application security testing (SAST/DAST / SCA) tools. Will be responsible for Secure Coding Practices Required education Bachelor's Degree Preferred education Master's Degree Required technical and professional expertise BE / B Tech in any stream, M.Sc. (Computer Science/IT) / M.C.A, with Minimum 5 plus years of experience Application Security TestingExperience with static and dynamic application security testing (SAST/DAST/ SCA) tools. Secure Coding PracticesKnowledge of secure coding standards (e.g., OWASP Top Ten) and experience in reviewing code for security vulnerabilities. Threat ModelingAbility to conduct threat modeling sessions to identify and mitigate security risks Preferred technical and professional experience Vulnerability AssessmentExperience in conducting vulnerability assessments and penetration testing Application Security TestingExperience with static and dynamic application security testing (SAST/DAST) tools. Security ToolsProficiency in using security tools like Burp Suite, Nessus, or Fortify

Role & responsibilities Ensure compliance with DevSecOps SLA's. Implement secure development practices : Conduct security design/architecture reviews, threat modeling, and secure code reviews. Manage secure application environments : Understand deployment baselines and exception handling. Improve service reliability through automation and tools. Perform security assessments : Both manual and automated. Triage and track defects with development teams. Liaise between development and infrastructure teams for integrated processes. Analyze and monitor emerging and existing application security threats. Track threat actors and their TTPs impacting the client.

Required Skills: Cyber Risk Risk Mitigation Strategies for Security Controls SAST and DAST Tools Profile: - 5+ years of experience in application/API security, risk management, or related fields - Strong understanding of application security architecture, compliance frameworks, and risk management principles - Experience with application security assessments, risk assessments, and security controls implementation - Excellent analytical, problem-solving, and communication skills - Familiarity with cloud security framework, tools, and technologies (e.g., OSWAP, CSPM, CWPP, CIEM, DAST/SAST) - Certifications in cloud security, risk management, or related fields (e.g., CCSK, CRISC, CISSP) Job Summary: We are seeking a seasoned Cyber Risk Consultant to assess and mitigate risks associated with our private cloud control plane (API Services). The successful candidate will perform risk assessments, identify vulnerabilities, and develop strategies to optimize security and compliance in control plane. Responsibilities: - Conduct risk assessments and security evaluations of private cloud control plane services (API Services) - Identify and prioritize vulnerabilities, threats, and potential attack vectors - Develop and implement risk mitigation strategies and security controls - Evaluate security configurations, policies, and procedures - Assess compliance with industry standards and regulatory requirements (e.g., NIST, SOC 2, PCI-DSS, OSWAP) - Develop and maintain risk management frameworks, playbooks, and reporting dashboards - Stay current with emerging application/API security threats and technologies - Communicate risk and security recommendations to stakeholders

Job Title: Application Security Engineer SAST & DAST Experience Required: 3 to 8 Years Location: Hyderabad / Bangalore / Chennai / Mumbai / Pune / Kolkata / Gurgaon Mode of Interview: MS Teams (12 rounds) Notice Period: 0 to 30 Days Job Overview: We are looking for an experienced Application Security Engineer specializing in SAST & DAST to join our growing team. The ideal candidate will be responsible for integrating security throughout the software development lifecycle (SDLC), implementing and managing security tools, and driving security best practices across the organization. Key Responsibilities: Implement and manage application security testing activities throughout the development, deployment, and maintenance phases. Perform Static Application Security Testing (SAST) using tools like Checkmarx and Fortify . Execute and manage Dynamic Application Security Testing (DAST) tools such as AppScan and WebInspect . Conduct secure code reviews in languages including Java, .NET, Swift, Objective-C . Integrate security tools in DevOps pipelines and CI/CD environments (e.g., Jenkins, TeamCity, Bamboo, Chef, Puppet). Apply OWASP Top 10 , SANS Secure Coding Practices , and Security Engineering Principles during development and assessment. Analyze, triage, and report vulnerabilities using CVSS scoring and determine business impact. Perform penetration testing for web, mobile, and desktop applications. Implement mobile security testing techniques, including bypassing SSL pinning , root detection , reverse engineering , and manifest analysis . Work with containerized environments such as Docker and Kubernetes . Utilize at least one scripting language (e.g., Python, Bash, PowerShell) for automation or security tooling. Required Skills & Experience: Strong experience with SAST and DAST tools (Checkmarx, Fortify, AppScan, WebInspect) Familiarity with OWASP Top 10 , secure coding practices, and vulnerability remediation Proficient in secure code review for Java, .NET, Swift, Objective-C Solid understanding of DevSecOps practices and security toolchain integration Hands-on experience with CI/CD tools (Jenkins, TeamCity, Bamboo, etc.) Experience with container security in Docker/Kubernetes environments Knowledge of CVSS scoring and vulnerability risk assessment Understanding of mobile application security techniques and concepts Experience with scripting in Python, Bash, or equivalent Preferred Qualifications: Security certifications (e.g., CEH, OSCP, GWEB, GWAPT, Security+ ) Exposure to cloud environments (AWS, Azure, GCP) from a security standpoint Familiarity with automated testing tools like Selenium Experience working in Agile and DevOps environments Interested Candidates can share your updated resume to subashini.gopalan@kiya.ai

Consultant - MAST Vanguard Requirements: Mandatory Technical & Functional Skills Strong knowledge on manual secure code review against common programming languages (Java, C#) Minimum three (3) years of recent experience working with application tools to perform security tests: AppScan, NetsSparker, Acunetix, Checkmarx, Veracode, BurpSuite, OWASP ZAP, Kali Linux, or equivalent. Minimum three (3) years of performing manual penetration testing and code review against web apps, mobile apps, and APIs Minimum three (3) years of working with technical and non-technical audiences in reporting results and lead remediation conversations. Preferred one year of experience in development of web applications and/or APIs. Should be able to identify and work with new tools / technologies to plug and play on client projects as needed to solve the problem at hand. One or more major ethical hacking certifications not required but preferred; GWAPT, CREST, OSCP, OSWE, OSWA Job Description: Roles & responsibilities Perform manual application penetration tests on one or more of the following to discover and exploit vulnerabilities: web applications, internal applications, APIs, internal and external networks, and mobile applications Perform manual security code review against common programming languages (Java, CSharp). Perform automated testing of running applications and static code (SAST, DAST). Experience in one or more of the following a plus: AI pen testing. Need to work on application tools to perform security tests: AppScan, NetsSparker, Acunetix, Checkmarx, Veracode, BurpSuite, OWASP ZAP, Kali Linux. Able to explain IDOR, Second Order SQL Injection, CSRF Vulnerability, Root cause, Remediation

Roles & Responsibilities : - Working closely with the CTO and members of technical staff to meet deadlines. - Working with an agile team to setup and configure GitOps (CI/CD) based pipelines on GitLab - Create and deploy Edge AIoT pipelines using AWS Greengrass or Azure IoT - Design and develop secure cloud system architectures in accordance with enterprise standards - Package and automate deployment of releases using Helm charts - Analyze and optimize resource consumption of deployments - Integrate with Prometheus, Grafana, Kibana etc. for application monitoring - Adhering to best practices to deliver secure and robust solutions Requirements : - Experience with Kubernetes and AWS - Knowledge of cloud architecture concepts (IaaS, PaaS, SaaS) - Knowledge of Docker and Linux bash scripting - Strong desire to expand knowledge in modern cloud architectures - Knowledge of System Security Concepts (SAST, DAST, Penetration Testing, Vulnerability analysis) - Familiarity with version control concepts (Git) Apply Insights Follow-up Save this job for future reference Did you find something suspiciousReport Here! Hide This Job Click here to hide this job for you. You can also choose to hide all the jobs from the recruiter.

Role Summary Join our team as a Splunk Sales Engineer, where you'll help redefine how businesses use information in decision-making This is your chance to lead the evaluation stage of the sales process, serving as the key advisor for Splunks innovative offerings alongside our sales team, customers, and partners! What This Role Gets To Do Competent in showcasing and promote Splunks products and services through presentations and engaging webinars, both onsite and at industry events, Serve as a trusted Functional Specialist, conveying the value of Splunk's technology and applications to both technical and business customers, Develop tailored solutions by understanding and addressing each customer's outstanding needs and challenges, Build and maintain strong, collaborative relationships with a diverse range of customer from technical staff to senior management, throughout the sales cycle, Lead the technology evaluation phase, independently guiding prospects and customers through technical queries and solution exploration, Respond efficiently and with competence to functional and technical elements of RFPs and RFIs, driving comprehensive and customer-centric solutions, Participate in complicated proof-of-concept /proof-of-value events, collaborate with a team with varied strengths to establish success criteria and communicate valuable outcomes, Quickly adapt to new tools and processes, making valuable contributions to the continuous improvement of our Solutions Engineering team, Competent participation and/or working with a wider team in Unified Engagement Model (UEM) on moderately complicated accounts, Drive overall customer satisfaction through all the stages of the sales lifecycle, Partner with marketing to build impactful content and showcase Splunk's value in marketing and industry events, Must-have Qualifications A competent Presales / Technical Sales experience in a software vendor environment with validated results in technical software vendor sales, Able to conduct discovery sessions to understand customer business goals and demonstrate how Splunk can deliver targeted solutions, Experience in crafting detailed responses to RFIs/RFPs, showcasing reliability and technical acuity, A strong teammate who thrives in the technology assessment phase, actively contributing as a crucial technical advisor, Excellent knowledge of Company's overall IT technology Ability to investigate technicalities when needed to provide hands-on demonstrations, Great analytical problem solving and decision making skills and competent to work independently to resolve, identify issues, risks and suggest mitigations strategies, Competent to identify all technical issues of your assigned accounts to assure customer satisfaction throughout the UEM process Establish and maintain positive relationships with your customer technical decision makers and staff, Strong communications, presentation and interpersonal skills, Willingness to travel where required, Technical Literacy Security controls within an enterprise environment (eg Firewalls, IDPS, Proxies/Load Balancers, WAF, EDR, Cloud Security, Container Security, SAST/DAST, DDoS etc) SIEM, XDR, SOAR, TIP technologies SOC processes and procedures MITRE ATT&CK Framework Additional frameworks eg NIST\ISO27001\Cyber Kill Chain Emerging security trends e-g AI\ML, Bedrock Nice-to-have Qualifications Strong self-motivation and well-rounded growth mindset to thrive in a dynamic, fast-growing, constantly evolving environment and learn new technologies, Relevant certifications in CISSP/CEH/GIAC/CCSP, AWS/Azure/GCP

Company Overview: At Toast, we are committed to creating innovative solutions that enhance security and leverage the power of artificial intelligence to drive restaurant business growth and help them thrive. We are seeking a highly skilled and versatile engineer who specializes in application security to join our dynamic team. Job Summary: The Senior Application Security Engineer will be responsible for designing, implementing, and maintaining secure applications and collaborate closely with development teams to embed security best practices throughout the software development lifecycle (SDLC). This role requires a deep understanding of security principles, cloud architecture, and AI technologies to ensure our systems are robust, scalable, and secure. Key Responsibilities: Application Security: Conduct security assessments and code reviews to identify and mitigate vulnerabilities in web, mobile applications and APIs. Identify, analyze, and prioritize security risks and vulnerabilities. Implement and manage security protocols and measures to protect applications from threats. Develop and maintain security tools and frameworks to support secure software development. Develop and execute security testing strategies to validate the effectiveness of security controls. Promote and enforce security best practices throughout the SDLC. Provide guidance on secure coding principles, secure design patterns, and cryptographic techniques. General Security Practices: Stay current with the latest security threats, vulnerabilities, and technology trends. Develop and deliver security training and awareness programs for engineering teams. Work closely with cross-functional teams to embed security best practices throughout the development lifecycle. Required Skills and Qualifications: Education: Bachelors or Master’s degree in Computer Science, Engineering, Information Security, or a related field. Experience: Minimum of 5 years of experience in application security domain Proven experience with secure software development practices and tools (e.g., SCA, SAST, DAST). Proven experience with pentesting of web applications, mobile applications (Android and IOS) and APIs (REST and GraphQL) Technical Skills: Strong programming skills in languages such as Python, Java, Kotlin, C++, or similar. Deep understanding of security principles, cryptography, and secure coding practices. Familiarity with DevSecOps practices and CI/CD pipelines. Knowledge of containerization technologies (e.g., Docker, Kubernetes) and their security implications. Experience with AI security testing tools and techniques. Soft Skills: Excellent problem-solving and analytical skills. Strong communication and collaboration abilities. Ability to work independently and as part of a team in a fast-paced environment. Preferred Qualifications: Relevant security certifications such as CISSP, CEH, or similar. Knowledge of frameworks such as OWASP, SANS. Knowledge of compliance frameworks such as PCI, ISO, GDPR, or similar. Benefits : Competitive salary and performance-based bonuses. Flexible working hours and remote work options. Comprehensive health insurance and wellness programs. Professional development opportunities and continuous learning. Collaborative and inclusive company culture.

locationsBangalore RMZ-ECO WORLDposted onPosted Yesterday time left to applyEnd DateJune 14, 2025 (28 days left to apply) job requisition idR177746 , India Job Family Group: Information Technology (IT) Worker Type: Regular Posting Start Date: May 15, 2025 Business unit: Projects and Technology Experience Level Experienced Professionals About The Role Whats the role As a Cyber Threat Prevention Advisor in the CyberDefence SecOps team, you'll join the Vulnerability team to manage and oversee vulnerability processes, ensuring they are trackable and measurable with robust tool support. Your team will lead the implementation of these processes within ServiceNow Security Operations (SecOps), establishing standard workflows and integrating them with IT service management processes executed by Line of Defence 1 within IRM. This role leverages market-standard tools and practices to streamline the architecture by reducing dependency on Collective. What youll be doing Asset Discovery: Set-up and lead adequate discovery of new Shell IT assets in Shell's legacy IT network, RES & Portfolio companies, Cloud environments and PCD and Retail environments. Ensure visibility in new areas such as Internet of Things and Cloud and investigate possibilities to keep track of IT assets. Automated Vulnerability Scanning: Maintain a portfolio of tools for automated vulnerability scanning with a focus on Business-Critical systems and systems that are available from the public Internet. Set-up regular scanning and make results available for further analytics in IRM investigation platform. Take appropriate action on vulnerabilities where required. Security Posture Reporting: Use the results from asset discovery, vulnerability scanning, penetration testing and attack simulation to provide an overview of vulnerabilities in Shell IT landscapes for different stakeholders including IRM LT and IDSO LT. Create specific reports for Business, Business Critical applications, IDSO service lines, External perimeters etc. Act as a Subject Matter Expert on implications of a vulnerability in an IT system and establishing the priority of applying security patches. Help creating prioritized overviews of Cyber vulnerabilities and putting these in a context of IT services and Business applications. Take mitigating actions coming out of identified threats or vulnerabilities either directly by the team or agree the actions with other parties in Shell. What you bring Bachelors degree in Computer Science, Information Technology, or related field 5-8 years of total experience in IT Security including at least 3-4 years of experience in Vulnerability Assessment Proficient in analysing network traffic using tools such as tcpdump or wireshark Strong experience in using open-source scanning tools such as nmap, nessus, metasploit and/or commercial tools such as Rapid7 or Qualys Knowledge in integrating Vulnerability Management into modern CI/CD Pipelines with 'shift-left' strategy Understanding of Network Security, Cloud Security, Endpoint Security, Application Security Understanding Cyber Threat Landscape and analyzing Threats from various sources. Assess new threats, rate threat per Shell ratings and collaborate with Threat team on new threat criticality Understanding of CVE id / CVSS score and metrics Familiar with application of Cybersecurity Benchmarks, NIST controls, PCI controls Lead security research proposals and Proof Of Concepts for Emerging Technologies and assessing Fit-For-Purpose Tools. Understanding of Cloud Security Posture Management (CSPM) Expertise in operating Application security tools like Rapid7 Appspider, Netsparker Knowledge on CI/CD pipeline able to understand the integration of security tools and guide the developers Understanding of Application security design and providing guidance to developers on secure design. Good understating of SAST/DAST concepts and process Knowledge of Mobile DAST scanning and vulnerabilities and remediation consultation Knowledge of Splunk, SecOps VR, basic querying and creating dashboards Additional Skills (Good to have): PCI-DSS Compliance Scan. SecOps VR Module in ServiceNow. Linux environment experience. Azure/AWS Cloud Console. Wiz.io tool knowledge. Advanced Splunk skills. What we offer You bring your skills and experience to Shell and in return you work with talented, committed people on one of the most important challenges facing our planet. Youll have the opportunity to develop the skills you need to grow in an environment where we value honesty, integrity, and respect for one another. Youll be able to balance your priorities as you become the best version of yourself. Progress as a person as we work on the energy transition together. Continuously grow the transferable skills you need to get ahead. Work at the forefront of technology, trends, and practices. Collaborate with experienced colleagues with unique expertise. Achieve your balance in a values-led culture that encourages you to be the best version of yourself. Benefit from flexible working hours, and the possibility of remote/mobile working. Perform at your best with a competitive starting salary and annual performance related salary increase our pay and benefits packages are considered to be among the best in the world. Take advantage of paid parental leave, including for non-birthing parents. Join an organisation working to become one of the most diverse and inclusive in the world. We strongly encourage applicants of all genders, ages, ethnicities, cultures, abilities, sexual orientation, and life experiences to apply. Grow as you progress through diverse career opportunities in national and international teams. Gain access to a wide range of training and development programmes. We'd like you to know that Shell has a > click here . - Shell in India Shell is a diversified energy company in India with 13,000 employees, and presence in Integrated Gas, Downstream, Power, Renewable and Upstream. Additionally, we have deep capabilities in R&D, digitalisation, and business operations. Our global strategy, Powering Progress, is designed to generate value for our shareholders, customers, and the wider society, and focuses on creating more value with less emissions. The strategy supports our purpose of providing more and cleaner energy solutions, with the aim of profitably transforming Shell into a net-zero emissions energy business by 2050. As India moves towards its target of net-zero emissions by 2070, Shell India aims to play a leading role in securing vital energy for today, while investing in, and helping to build, the energy system of the future through strategic investments in the country. Our Lubricants business serves over 50,000 consumers through a strong network of over 200 distributors, and operates an end-to-end value chain that spans conceptualization, development, and production at a world-class blending plant at Taloja. Through our 350-plus retail stations, we offer an integrated mobility experience including fuels, cafes, and convenience stores, with a prominent network of EV recharging facilities. Shell owns and operates a LNG re-gasification terminal at Hazira, Surat, with a capacity of 5 MTPA and a LNG truck-loading unit that plays a crucial role in helping meet Indias growing demand for gas across sectors. In 2022, Shell acquired Sprng Energy in a $1.55 billion deal to build an integrated energy transition business in the country. Sprng is a leading renewable energy company in India which develops and manages solar, wind, and hybrid power generation facilities and infrastructure. Our three capability centres across Bangalore and Chennai serve as a technology and innovation powerhouse for Shell globally, working as a delivery engine for core technical, digital, and finance processespioneering digital innovation and cutting-edge technologies across the energy sector. We also have strong academic partnerships and collaborations with leading universities and technology institutes to accelerate decarbonization efforts within the energy sector. We are committed to positively contributing to the communities in which we operate through programmes on STEM Education, Skilling, and Livelihood across India. We nurture and invest in startups developing initiatives focused on accelerating energy innovation through programs such as Shell E4 and Shell Eco-marathon. We also have strategic investments in new energy companies such as Husk Power, d.light, Orb Energy, and Cleantech Solar. DISCLAIMER: Please noteWe occasionally amend or withdraw Shell jobs and reserve the right to do so at any time, including prior to the advertised closing date. Before applying, you are advised to read our data protection policy. This policy describes the processing that may be associated with your personal data and informs you that your personal data may be transferred to Shell/Shell Group companies around the world. The Shell Group and its approved recruitment consultants will never ask you for a fee to process or consider your application for a career with Shell. Anyone who demands such a fee is not an authorised Shell representative and you are strongly advised to refuse any such demand. Shell is an Equal Opportunity Employer.

Experience - 4 - 8 years Location - Hyderabad You are responsible for adhering to the defined operating procedures and guidelines in operating the application security services in the Managed Services model, which includes the following: Understand and be compliant with the Service Level Agreements defined for the DevSecOps services; Understand and deep knowledge of application security engineering principles, and helping clients development team and function to follow secure development practices which includes primarily monitoring and performing the security design review, architecture review, threat modeling, security testing, secure code review, secure build processes; Well versed with the application deployment and configuration baselines, and understanding of how the application environment operates in a secure environment and how exceptions are handled during operations; Facilitate use of technology-based tools or methodologies to continuously improve the monitoring, management and reliability of the service; Perform manual and automated security assessment of the applications; Involved in triaging and defect tracking process with the development team and helping the team to fix issues at the code level based on the priority of the tickets; Be a liaison between the Application development and infrastructure team, and integrate the processes between infrastructure monitoring and operations processes with the secure development/testing and management processes; Identifying, researching and analyzing application security events which may include emerging and existing persistent threats to the client's environment; and Performing active monitoring and tracking of application related threat actors and tactics, techniques and procedures (TTPs), that could likely cause an impact to client organization

Roles & responsibilities Perform manual application penetration tests on one or more of the following to discover and exploit vulnerabilities: web applications, internal applications, APIs, internal and external networks, and mobile applications Perform manual security code review against common programming languages (Java, CSharp). Perform automated testing of running applications and static code (SAST, DAST). Experience in one or more of the following a plus: AI pen testing. Need to work on application tools to perform security tests: AppScan, NetsSparker, Acunetix, Checkmarx, Veracode, BurpSuite, OWASP ZAP, Kali Linux. Able to explain IDOR, Second Order SQL Injection, CSRF Vulnerability, Root cause, Remediation Mandatory technical & functional skills Strong knowledge on manual secure code review against common programming languages (Java, C#) Minimum three (3) years of recent experience working with application tools to perform security tests: AppScan, NetsSparker, Acunetix, Checkmarx, Veracode, BurpSuite, OWASP ZAP, Kali Linux, or equivalent. Minimum three (3) years of performing manual penetration testing and code review against web apps, mobile apps, and APIs Minimum three (3) years of working with technical and non-technical audiences in reporting results and lead remediation conversations. Preferred one year of experience in development of web applications and/or APIs. should be able to identify and work with new tools / technologies to plug and play on client projects as needed to solve the problem at hand. One or more major ethical hacking certifications not required but preferred; GWAPT, CREST, OSCP, OSWE, OSWA Shift-timings: 12 PM to 9 PM

•Strong knowledge on manual secure code review against common programming languages (Java, C#) •Minimum three (3) years of recent experience working with application tools to perform security tests: AppScan, NetsSparker, Acunetix, Checkmarx, Veracode, BurpSuite, OWASP ZAP, Kali Linux, or equivalent. •Minimum three (3) years of performing manual penetration testing and code review against web apps, mobile apps, and APIs •Minimum three (3) years of working with technical and non-technical audiences in reporting results and lead remediation conversations. •Preferred one year of experience in development of web applications and/or APIs. •should be able to identify and work with new tools / technologies to plug and play on client projects as needed to solve the problem at hand. •One or more major ethical hacking certifications not required but preferred; GWAPT, CREST, OSCP, OSWE, OSWA Job Description: Roles & responsibilities •Perform manual application penetration tests on one or more of the following to discover and exploit vulnerabilities: web applications, internal applications, APIs, internal and external networks, and mobile applications •Perform manual security code review against common programming languages (Java, CSharp). JOB DESCRIPTIONS 2 •Perform automated testing of running applications and static code (SAST, DAST). •Experience in one or more of the following a plus: AI pen testing. •Need to work on application tools to perform security tests: AppScan, NetsSparker, Acunetix, Checkmarx, Veracode, BurpSuite, OWASP ZAP, Kali Linux. •

About Product Security Engineer at Traveloka will be required to ensure that our products and services are shipped with high security standards through application security testing, hardening, and secure framework. A Product Security Engineer will be smart and self starter. The person needs to find unique ways to understand complex software architecture and should be able to perform manual security code review. They need to be able to integrate security in the software development process with defense-in-depth strategies such as automated testing in CI/CD pipeline. A Product Security Engineer preferably needs to have a software development background and should have practical programming knowledge. They will work very closely with our Software Engineering Team to implement Secure SDLC in Traveloka. They will also need to have proficiency in handling multiple projects based on different frameworks and groups. Responsibilities Carry out manual and automated review of source code to identify security vulnerabilities and risks Implement automated security testing tools (SAST, DAST, IAST) and their deployment within continuous integration systems Implement hardening and secure framework such as RASP, WAF, safe library, and security decorator functions Perform vulnerability assessment & penetration testing on web API, front-end service, internal RPC, and mobile application Attend design reviews and actively lead the discussions from a security standpoint Analyze possible security incident related to application security such as payment abuse or sensitive data exposure via web API Ensure that product security requirements are identified early on and are being baked into all projects Provide effective recommendations or patches to mitigate security vulnerabilities Develop in-house tools to integrate with SDLC and to track and derive security metrics Skills & Experience Academic background in Computer Science or equivalent Relevant professional experience or extensive experience in security activities (e.g. CTF, bug bounty, security research, publications, blog) Practical knowledge of modern software development such as microservices, application containerization, REST architecture, object oriented programming, stateless/stateful authentication, and cloud platform Working knowledge of one or more of these programming languages: Java, JavaScript, Kotlin, C#, Objective-C, Swift Experience in security code review, vulnerability assessment, and penetration testing. Knowledge of common vulnerabilities such as OWASP Top 10 and CWE including business logic issue (e.g. IDOR) Core skill set in two or more of the following areas: JavaScript framework (e.g. React) Java framework (e.g. Spring) Android / iOS platform DevOps AWS Automation tool development Dynamic debugging Unit testing Algorithm & data structure If you like wild growth and working with happy, enthusiastic over-achievers, you'll enjoy your career with us!

Job Title : Security Engineer - Contractual Role Experience Required : 2-4 years. Job Summary : Seeking for a highly skilled and motivated Web Application Firewall (WAF) and Bot Operations Security Engineer who will play a crucial role in ensuring the security and resilience of our organisations systems, networks, and infrastructure. He will be responsible for deploying, configuring, and managing Web Application Firewalls (WAFs) and bot mitigation solutions to protect our web applications from various cyber threats and malicious activities. This role involves a deep understanding of web application security, bot management, and hands-on experience with WAF technologies and bot mitigation tools. Required Skills: The candidate should have minimum experience of 3 years in Vulnerability management to carry out WAF & BOT solutions. Mandatory : 3+ years of experience in web application security, including hands-on experience with WAF technologies and bot mitigation tools (e.g., Akamai, Cloudflare, Imperva, AWS WAF, Azure Application Gateway, F5 BIG-IP). Strong understanding of web application vulnerabilities, attack vectors, and mitigation techniques. Experience with security monitoring and incident response. Good to have: Proficiency in scripting languages (e.g., Python, Bash) for automation and custom rule creation. Knowledge of web technologies, including HTTP/HTTPS, HTML, JavaScript, and APIs. Familiarity with security frameworks and standards (e.g., OWASP, CIS). Certification: Mandatory : Relevant security certifications such as CISSP, CISM, CEH, or other industry-recognized credentials. Good to have: Certifications such as CREST Practitioner Security Analyst (CPSA), Certified Expert Penetration Tester (CEPT) etc. Qualifications : 1. Bachelors degree in Computer Science, Information Security, or related field (or equivalent experience). 2. Strong understanding of networking protocols, operating systems, and security technologies. 3. Excellent analytical and problem-solving skills. 4. Proficient in at least one scripting language. Responsibilities : WAF Management: Deploy, configure, and maintain Web Application Firewalls to protect web applications from threats such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities. Develop and implement custom WAF rules and policies to address specific security requirements and threat landscapes. Monitor WAF performance and fine-tune rules to minimize false positives and negatives. Bot Mitigation: Implement and manage bot detection and mitigation solutions (including advanced BOTs) to safeguard against automated attacks and scraping activities. Analyze bot traffic patterns and behaviour to fine-tune detection and mitigation strategies. Stay updated on emerging bot threats and mitigation techniques, and proactively adjust strategies to counteract new attack vectors. Incident Response: Investigate and respond to security incidents, attack scenarios related to web applications and bot activities. Perform root cause analysis for security events and provide recommendations for improvements to prevent recurrence. Must be willing to be available during off-hours and weekends for incident response and attack scenarios as needed. Collaboration and Communication: Work closely with application developers, system administrators, and other stakeholders to address security concerns and ensure secure application deployment. Provide security guidance and best practices to teams across the organization to enhance overall security posture.