Job Description: Lead — Security, GRC
& Application Security

Role Summary

This role leads Pragma Edge's end-to-end security function — spanning
governance/compliance, application security, cloud & infrastructure
security, threat monitoring, and external attack surface management. The Lead
owns the security posture across internal systems, client-facing products, and
cloud/on-prem infrastructure, and is the primary point of accountability for
audit readiness, client TPRM responses, and remediation across every layer of
the stack.

Core Responsibilities
Governance, Risk & Compliance (GRC)
Own and
maintain security policies (Access Control, Incident Response, Data
Protection, SDLC) — review and update on a recurring cycle.
Conduct risk
assessments and client Third-Party Risk Management (TPRM) reviews;
maintain and update the Vanta risk register and track remediation to
closure.
Map controls to
ISO 27001, SOC 2, NIST, and OWASP standards.
Own audit
evidence collection — logs, screenshots, approvals — for both internal and
external audits.




Lead quarterly
internal audits (client-specific) and HR audits; own annual external audit
and ongoing Vanta compliance management.
Application Security & Secure Development
Perform secure
code reviews on critical APIs and backend services.
Own OWASP Top
10 remediation (BOLA, BFLA, Injection, Security Misconfigurations).
Run Software
Composition Analysis (SCA) — dependency vulnerability management, SBOM
generation, license review, remediation validation.
Own SAST
scanning across JAR, Python, and Maven artifacts using Mend/WhiteSource;
own DAST scanning (web app + API) using OWASP ZAP and Burp Suite.
Run
container/image vulnerability scanning (Mend CLI).
Coordinate
SAST/DAST/SCA findings with development teams, validate fixes, and perform
rescans.
Penetration Testing
Build and
execute pentesting plans for web applications, APIs, and products.
Own client
communication throughout pentest engagements,

📌 Security And Grc Specialist Hyderabad (India)
🏢 Pragma Edge
📍 India