DevSecOps Application Security Engineer

In the assigned Job Role, your Area Of Responsibility will be as below:

• Collaborate with internal and client teams to resolve complex incidents, conduct root cause analyses, and document findings with preventive recommendations
• Participate in evaluation of client IT infrastructure, prepare actionable assessment reports, and support due diligence to document infrastructure maturity and improvement opportunities
• Contribute to the design of scalable, cost-effective IT infrastructure solutions, review reusable components, and develop technical documentation for deployed systems
• Align release schedules and environment readiness, execute deployments as per protocols, perform post-deployment testing, and manage version control to track changes
• Co-ordinate maintenance schedules, emergency fixes, and technology upgrades while ensuring uninterrupted integration into existing systems and processes
• Facilitate performance data analysis across systems, coordinate insights on system behavior, and support capacity planning to optimize performance
• Conduct security checks, recovery drills, and compliance audits, implement security measures, and coordinate continuity plans to maintain adherence to standards
• Gather feedback to identify automation opportunities, analyze existing infrastructure processes, and propose enhancements for efficiency gains
• Act as liaison with onsite, offshore, and vendor teams to document project requirements, ensuring effective collaboration
• Develop a centralized repository of technical and procedural knowledge, leveraging insights from other projects to drive efficiency and retain organizational expertise

• A collaborative spirit and excellent communication skills.
• Ability to handle complex incidents and implement resolutions
• A knack for conducting IT infrastructure assessment and identifying key optimization opportunities
• Focused approach towards deployment management, system optimization, and process automation initiatives including sector specific focus
• The ability to work with cross-functional teams

• Application Security Testing:
  Conduct SAST/SCA using GHAS and DAST using Burp Suite; validate and classify vulnerabilities aligned with OWASP.
• Dev Sec Ops  & Integration:
  Integrate GHAS into CI/CD, automate scans across SDLC, configure policies, reduce false positives, and enable shift-left security with development teams.
• Vulnerability Management:
  Analyze findings, provide remediation guidance, track vulnerabilities through lifecycle, and support risk-based prioritization.
• Reporting & Stakeholder Management:
  Prepare technical and executive reports, communicate findings with stakeholders, and support audits, compliance, and App Sec initiatives.

• Security Advisory & Review:
  Conduct secure code reviews and architecture level assessments;
  Coordinate with development teams on secure coding and mitigation strategies.
• Knowledge Of: SDLC and Dev Sec Ops  practices, microservices/API/cloud security, strong analytical/problem-solving skills, and stakeholder communication/consulting experience.

• Exposure to SAST (Fortify, Sonar Qube), DAST (Netsparker, Fortify on Demand), and SCA (Black Duck, Dependabot) tools.
• Experience in threat modeling and architecture reviews.