Security Assurance Expert

Security Resource to perform the following:

• Continual penetration testing across production and staging environments.
• Identify, document, and report vulnerabilities and exploit paths.
• Validate remediation efforts and provide retesting.
• Support compliance with regulatory standards (e.g., PCI DSS, ISO 27001)
• Provide threat modelling and risk assessments.
• Collaborate with Dev Ops and security teams to integrate testing into CI/CD pipelines.

• 2-3 experienced security professionals (full-time equivalent) with proven expertise in:
• Dev Sec Ops  implementation and CI/CD pipeline security
• Cloud infrastructure security assessments
• Penetration testing and API security
• Security frameworks and compliance standards
• Dev Sec Ops  Implementation Plan and CI/CD Integration Report.
• Monthly Cloud Security Posture Reports and Remediation Status.
• Quarterly Penetration and API Security Testing Reports.
• Security Posture & Gap Analysis Report (Initial and Final).
• Training sessions and supporting documentation for internal teams.

• Dev Sec Ops  Security Methodology Implementation
• Design, develop, and implement Dev Sec Ops  practices across development pipelines.
• Integrate security gates within CI/CD workflows to enforce code quality and compliance.
• Utilize existing or recommended code scanning tools (e.g., Sonar Qube, opentext Fortify) for:
• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Software Composition Analysis (SCA)
• Provide documentation and training for Dev Sec Ops  processes to development teams.
• Cloud Security Posture Assessment and Remediation :
• Perform initial and ongoing assessments of security configurations across all cloud subscriptions.
• Identify misconfigurations, insecure practices, and compliance issues.
• Use tools such as Microsoft Defender for Cloud, CSPM or similar.
• Collaborate with internal teams to prioritize and remediate identified issues.
• Track and report remediation progress monthly.
• Continuous Assurance via Penetration Testing and API Security Assessment
• Conduct penetration testing of application services on a quarterly basis or aligned with project milestones.
• Scope to include:

• Web applications
• Cloud-native services
• Public and internal APIs
• Dedicated API Security Assessments to cover:
  Authentication and authorization flaws
• Lack of rate limiting
• OWASP API Security Top 10

• Apply a combination of automated and manual techniques using tools like OWASP ZAP, Postman, and Burp Suite Pro.

Provide detailed findings, including:

• Vulnerability descriptions
• Risk severity (CVSS or equivalent)
• Business impact
• Remediation recommendations
• Proof-of-concept evidence where applicable
• Retest resolved issues to confirm closure and ensure continued resilience.
• Support development teams in triaging, prioritizing, and remediating vulnerabilities.

• Conduct a baseline assessment of the current security posture.
• Perform a gap analysis against relevant frameworks and standards such as:
• ISO 27001
• NIST Cybersecurity Framework
• Develop and deliver a remediation roadmap with clear priorities, timelines, and resource estimates.
• Present assessment outcomes and recommendations to stakeholders.