: Lead — Security, GRC & Application Security

Role Summary

This role leads Pragma Edge's end-to-end security function — spanning governance/compliance, application security, cloud & infrastructure security, threat monitoring, and external attack surface management. The Lead owns the security posture across internal systems, client-facing products, and cloud/on-prem infrastructure, and is the primary point of accountability for audit readiness, client TPRM responses, and remediation across every layer of the stack.

Core Responsibilities

1. Governance, Risk & Compliance (GRC)

- Own and maintain security policies (Access Control, Incident Response, Data Protection, SDLC) — review and update on a recurring cycle.

- Conduct risk assessments and client Third-Party Risk Management (TPRM) reviews; maintain and update the Vanta risk register and track remediation to closure.

- Map controls to ISO 27001, SOC 2, NIST, and OWASP standards.

- Own audit evidence collection — logs, screenshots, approvals — for both internal and external audits.

- Lead quarterly internal audits (client-specific) and HR audits; own annual external audit and ongoing Vanta compliance management.

2. Application Security & Secure Development

- Perform secure code reviews on critical APIs and backend services.

- Own OWASP Top 10 remediation (BOLA, BFLA, Injection, Security Misconfigurations).

- Run Software Composition Analysis (SCA) — dependency vulnerability management, SBOM generation, license review, remediation validation.

- Own SAST scanning across JAR, Python,



and Maven artifacts using Mend/WhiteSource; own DAST scanning (web app + API) using OWASP ZAP and Burp Suite.

- Run container/image vulnerability scanning (Mend CLI).

- Coordinate SAST/DAST/SCA findings with development teams, validate fixes, and perform rescans.

3. Penetration Testing

- Build and execute pentesting plans for web applications, APIs, and products.

- Own client communication throughout pentest engagements, produce findings reports, and drive remediation to closure.

4. Cloud & Infrastructure Security

- Review cloud IAM, network rules, and storage exposure; own security hardening (insecure configs, headers, TLS, secrets).

- Run infrastructure vulnerability assessments (Active Directory, switches, routers, internal servers) via Nessus.

- Run cloud compliance scans and client-specific AWS security/compliance assessments via Nessus.

- Own network security review, configuration validation, and hardening recommendations.

- Manage on-prem security: installation requests, firewall changes, domain whitelisting, and inbound/outbound IP access control.

- Validate backup, restore, and DR readiness; improve audit logging and SIEM integration.

5. Threat Monitoring & Security Operations

- Monitor security logs (Trend Micro)



and firewall logs (Sophos) — event review, traffic analysis, and investigation.

- Coordinate remediation with Infrastructure, Cloud, Networking, and Development teams; produce vulnerability reporting across infrastructure, cloud, application, and product layers.

6. External Attack Surface Management

- Run weekly public IP discovery and maintain external asset inventory.

- Perform external reconnaissance, port scanning, and service enumeration.

- Own subdomain enumeration, takeover validation, and DNS verification.

- Run external vulnerability scanning and validation; monitor for exposed company-sensitive information on the internet.

7. Training, Awareness & Documentation

- Run security awareness training and phishing simulations; run developer secure-coding sessions (OWASP/API security).

- Prepare security assessments, training plans, test evaluations, and score analysis.

- Own compliance documentation: Access Change Requests, Device Disposal records, Incident Response documentation, Tabletop Exercise (TTE) documentation.

- Own security documentation: policies, assessment reports, remediation reports.

- Provide audit support: quarterly evidence, compliance reporting, vulnerability tracking, and exit-access revocation verification.

Requirements

Tools & Stack

Vanta (GRC/compliance), Mend/WhiteSource (SAST, SCA, container scanning), OWASP ZAP & Burp Suite (DAST), Nessus (infra/cloud vulnerability assessment), Trend Micro (log monitoring), Sophos (firewall monitoring).

📌 Security and GRC Specialist - 5-10Yrs - Hyderabad
🏢 Pragma Edge
📍 Hyderabad