Specialist, Vulnerability Assessment, Cyber/IT Security, Technology & Operations

Business Function

Technology and Operations (T&O) enables and empowers the bank with an efficient, nimble and resilient infrastructure through a strategic focus on productivity, quality & control, technology, people capability and innovation. In Group T&O, we manage the majority of the Bank's operational processes and inspire to delight our business partners through our multiple banking delivery channels.

Job Purpose

The purpose of this job role is to manage Information Security Internal & External Vulnerability Assessment, Penetration Testing, Application Security Assessment, Source code review follow up, Wireless PT, ATM/POS security Assessment, Secure Configuration Review, Vulnerability management domains to enhance threat detection and mitigation capabilities within the Bank. This role is additionally responsible for enhancing cyber assurance and appropriate regulatory reporting of cyber security aspects.

Key Accountabilities

• Vulnerability management and Penetration Testing
• Application security
• Virtualization and container technologies (Docker, Kubernetes, OpenShift).
• API Security
• CI/CD assessment
• IS Related compliance and regulatory reporting

Job Duties & Responsibilities

Vulnerability Management:

• Manage periodic internal and external VA scanning for the bank's production systems.
• Analyze and report/present the vulnerabilities to multiple stakeholders for remediation and prioritization
• Maintain intelligence network to discover any reported exploits, zero day vulnerabilities and its applicability to Bank.
• Experience with tools such as Rapid7, Nessus, Metasploit, QualysGuard, etc.

Security Testing & Application Security:

• Manage annual security testing program for the existing and new production systems.
• Maintain tools and environment to support security testing, working with internal teams and consultants as required
• Collaboratively work with Application Development / Security Mavens and guide them to follow the Security gates set in the Organization's SDL.
• Evaluate internal Technology Risk Processes as it relates to App Pentest, FOSS, Fortify SCA and provide process governance as well as though leadership concerning adjusting to future needs
• Liaison with customer relation and team responsible to address the external requests related to AppSec
• Coordinate Security Mavens training and manage monthly meetings
• Manage and update Key Performance Indicators (KPI's) for the Application Security Assurance Program
• Coordinate with team members and TRM policy management to ensure control standards and policies are up to date
• Manage the application security threat modeling process and coordinate application threat models against the Organization's applications
• Liaison with various internal teams (Application Development, IT Architecture, Corp. Procurement Services, Source Code Management, IT Asset Management) for Application security initiatives and automation efforts).
• Manage new projects and initiatives related to application security as needs arise
• Evangelize application security within the firm and work with Application Development Security Mavens to incorporate new program direction into applications
• Coordinate with ASAP team members to track internal audit and regulatory assessments and address requests related to the Application Pentest, SAST ,DAST and SCR (Source code review)
• Conduct presentations on application security topics for TRM and AD management
• Provides regular status updates on all assigned tasks and deliverables.
• Maintains issue logs, tracks/follows up on problems.
• Mitigates risk by following established procedures and monitoring controls, spotting key errors and demonstrating strong ethical behaviour.

Requirements

• Overall 6+ years on experience in Information/Cyber Security
• Experience in vulnerability management and application security for 4+ years
• Experience in managing 5+ members team which may include vendor teams
• Candidate should have worked in BFSI (preferred)

Education / Preferred Qualifications

• Graduation: BE IT/Computers/Electronics, B.Sc - Computers, M.Sc - Computers
• Post-Graduation: PGDIT, MCA, MBA
• Certification like CISSP, CISM, SANS, OSCP/OSCE and CREST (Prefered)

Core Competencies

• Excellent analytical and decision-making skill sets
• Effective in Communication, documentation and report writing skills
• Ability to consult and validate solutions to mitigates risks to business and systems

Technical Competencies

• VAPT - Rapid7, Nessus, Metasploit, QualysGuard, Burpsuite ,CI/CD tool etc.
• Technical working knowledge (WAF, HIDS, IPS, Firewall, Networking