Summary Position Summary We are seeking a Consultant– AI/ML/DevSecOps / Application Security with strong hands-on delivery experience in SAST, SCA, and DAST to embed security across the software development lifecycle. This role focuses on implementing and operating application security tooling in CI/CD pipelines, executing application security assessments (including API security), triaging and prioritizing findings, enabling remediation, and driving secure-by-design engineering practices across cloud-native and enterprise applications. SAST, SCA, and DAST remain foundational AppSec capabilities, and the role is positioned accordingly with an emphasis on measurable delivery outcomes (tool onboarding, pipeline coverage, risk reduction, and remediation closure). Work you'll do As a Consultant on the Cyber Operate team, you will be responsible for…
• Integrate, configure, and optimize static application security testing (SAST), software composition analysis (SCA), and dynamic application security testing (DAST) tools in continuous integration and continuous delivery (CI/CD) pipelines, including quality gates and exception workflows.
• Perform security assessments across application code, open-source dependencies, REST and GraphQL application programming interfaces (APIs), cloud-native workloads, containers, and Kubernetes environments to identify vulnerabilities, exposed secrets, configuration gaps, and software supply-chain risks.
• Triage scan results, validate findings, prioritize vulnerabilities based on exploitability and business impact, and provide remediation guidance, compensating controls, and verification steps.
• Facilitate threat modeling and security design reviews; translate risks into secure design requirements, test cases, acceptance criteria, and engineering backlog items.
• Implement DevSecOps controls, including infrastructure-as-code scanning, secrets detection, container image scanning, policy-as-code, software bills of materials, and build and release integrity controls.
• Design and build artificial intelligence agents and agentic workflows for application security automation; assess AI/ML and generative AI application risks; and deliver client reports, dashboards, trend analysis, and implementation roadmaps. The team Deloitte's Cyber Operate teams manage clients' critical cyber assets either as a fully managed service or in partnership with clients. They deliver skilled talent, cutting-edge technologies, and robust processes to operate client cyber capabilities. This includes:
• Managing Identity Lifecycle
• Security Operations
• Threat Intelligence
• Application Security




• Business Transformation
• Continuous Compliance

Location:
Bangalore, Hyderabad, Pune, Chennai, Kolkata Shift Timings: Rotational Qualifications Required:
• Bachelor’s degree or higher in Computer Science, Engineering, Cybersecurity, or another technical discipline.
• 3-6 years of hands-on application security or DevSecOps experience, including operation of SAST, SCA, and DAST capabilities in CI/CD pipelines.
• Experience with at least one application security tool: Checkmarx, Veracode, Fortify, Burp Suite, OWASP ZAP, Snyk, Mend/WhiteSource, or Black Duck.
• Experience integrating security controls into Jenkins, GitLab CI, GitHub Actions, or Azure DevOps, including pipeline templates, quality gates, and exception workflows; experience using Python or Bash for application security automation.
• Experience performing REST or GraphQL API security testing, including authentication and authorization testing, input validation, rate limiting, broken object-level authorization, and broken function-level authorization; experience with vulnerability triage and remediation validation.
• Experience conducting threat modeling and security architecture reviews for modern applications, microservices, or APIs.
• Experience designing and building AI agents or agentic workflows for security or engineering use cases, including tool or function calling, multi-step orchestration, logging, guardrails, and human validation. Preferred:
• Experience applying the OWASP Application Security Verification Standard to define or validate application security requirements.
• Experience implementing container or Kubernetes security, infrastructure-as-code scanning, secrets detection, or policy-as-code controls.
• Experience implementing software or AI/ML supply-chain controls, including software bills of materials, model bills of materials, artifact signing or verification, dependency pinning, build provenance, model registries, or data and model lineage.
• Experience applying artificial intelligence security guidance, including OWASP Top 10 for Large Language Model Applications, MITRE ATLAS, National Institute of Standards and Technology AI Risk Management Framework, or Google Secure AI Framework.




• Experience implementing large language model guardrails, safety controls, or agent sandboxing patterns.
• Certification in DevSecOps, cloud security, Kubernetes security, AI security, or generative AI, such as Certified Cloud Security Professional, Certified Kubernetes Security Specialist, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, Microsoft Certified: Azure AI Engineer Associate, or AWS Certified AI Practitioner. Our purpose Deloitte’s purpose is to make an impact that matters for our people, clients, and communities. At Deloitte, purpose is synonymous with how we work every day. It defines who we are. Our purpose comes through in our work with clients that enables impact and value in their organizations, as well as through our own investments, commitments, and actions across areas that help drive positive outcomes for our communities. Our people and culture Our inclusive culture empowers our people to be who they are, contribute their unique perspectives, and make a difference individually and collectively. It enables us to leverage different ways of thinking, ideas and perspectives, and bring more creativity and innovation to help solve our clients’ most complex challenges. This makes Deloitte one of the most rewarding places to work. Professional development At Deloitte, professionals have the opportunity to work with some of the best and discover what works best for them. Here, we prioritize professional growth, offering diverse learning and networking opportunities to help accelerate careers and enhance leadership skills. Our state-of-the-art DU: The Leadership Center in India, located in Hyderabad, represents a tangible symbol of our commitment to the holistic growth and development of our people. Explore DU: The Leadership Center in India . Benefits To Help You Thrive At Deloitte, we know that great people make a great organization. Our comprehensive rewards program helps us deliver a distinctly Deloitte experience that helps that empowers our professionals to thrive mentally, physically, and financially—and live their purpose. To support our professionals and their loved ones,

we offer
a broad range of perks. Eligibility requirements may be based on role, tenure, type of employment and/ or other criteria. Learn more about what working at Deloitte can mean for you. Recruiting tips From developing a stand out resume to putting your best foot forward in the interview, we want you to feel prepared and confident as you explore opportunities at Deloitte. Check out recruiting tips from Deloitte recruiters. Requisition code: 370546

📌 Cyber Operate (Hyderabad)
🏢 Deloitte
📍 Hyderabad