Job Title : Security Architect - Application Security - SSDLC

Reporting Structure : Reports to Chief Manager

Education : BE/BCA/B-TECH/B-TECH/BSc.IT or any IT Graduate from an authorised university

Experience/ Qualifications :

- Excellent written and verbal communication skills in English, high integrity, strong work ethic and ability to empathise with the customer.

- At least 8 - 12 years of Cyber Security experience with a large organisation, Bank, or global IT or consulting firm.

- Strong background in Application Security, Secure Software Development Lifecycle (SSDLC).

- Experience in Threat Modelling, Application Security Architecture Review, Security Testing- SCA, SAST, DAST.

- Exposure of security tools integration in DevOps architecture.

- Exposure of Microservices security and API security.

- Exposure implementation of evaluation and implementation of Application Security & Testing tools.

- Troubleshooting and problem-solving ability, including analytical thinking and strong attention to detail.

- Good understanding of Application Security Standards like OWASP, SANS, NIST, etc.

- Good understanding of Security by Design and Privacy by Design.

- Good understanding of compliance requirements for payment and nonpayment applications.

- Product & platform security assessment exposure is desirable.

- Understanding of Load Balancer, WAF, CDN, API Gateway, Secrets Management, etc. is desired.

- Exposure of cloud application (SaaS) security solutions is desirable.

- Good understanding of encryption tools and technologies; SSL, Keys Management, HSM and PKI infrastructure and secrets management.

- Ability to take an assessment solution and recommend proactive steps to mitigate Network, OS and Application Layer Security attacks.

Responsibilities :

- Subject Matter Expert for Application and Product Security.

- Understanding business requirements, complexity and solution architecture and estimating the scope and effort of SSDLC and Cyber Security.

- Driving SSDLC for projects from the initial stage to development and implementation.

- Planning, resource allocation and tracking of SSDLC service delivery.

- Conducting Threat Modelling, Application Architecture Review, SCA, SAST, DAST & IAST

- Implementation of SCA, SAST, DAST & IAST tools for application security testing.

- Continual learning and enhancement of skills and processes for service delivery.

- Provide advice on Secure coding best practices.

- Conduct Application Security-related training for the team and developers.

- Managing a small team of Application Security & SSDLC.

- Provide inputs for product and platform security.

- Assess application, product and platform security as per the scope of the engagement.

- Prepare application risk summary & register and trace for closure.

- Prepare weekly/monthly service delivery reports and review with BU Lead and VH.

- Provide service delivery inputs to PMO & other relevant systems.

- Develop Microservices & API security architecture.

- Work on DevSecOps integration and automation with the DevOps team.

- Face internal and external audits for the scope of service delivery.

- Participate in security risk assessments and audits.

- Build up and transfer interdisciplinary knowledge.

- Provide SME advice on security tool capabilities and configuration adjustments when needed to contain security incidents or block future security attacks.

- Troubleshooting experience with Data security and application troubleshooting.

- Coordinating with business and understanding their requirements regarding enhancements.

- Review of the effectiveness of controls and preparing Risk dashboards.

- Participate in continual improvement and benchmarking activities.

- Contribute to CoE initiatives and other activities delegated by the Reporting Manager or Vertical Head.

- Collaborate with internal and external stakeholders for the timely delivery of the assigned engagements/projects.

- Reviewing the status of the projects and taking corrective/preventive measures as approved.

Certifications :

- ISO 27001, CISSP, CISA, CSSLP, CEH, C|ASE, CSSD, GWEB, CMWPT, GPEN, API Security Architect