POSITION SUMMARY The Application Security Manager is responsible to lead and strengthen our application security program. The ideal candidate will have strong expertise in secure software development, application security testing, vulnerability management, DevSecOps, and security architecture.

The role involves partnering with engineering, product, cloud infrastructure, and security teams to embed security throughout the Software Development Life Cycle (SDLC), mitigate application vulnerabilities, and ensure compliance with industry security standards and regulatory requirements.

PRINCIPLE JOB RESPONSIBILITIES:

- Application Security Strategy and LeadershipDefine, implement, and continuously improve the organization's application security strategy, policies, standards, and procedures.
- Lead and mentor application security engineers and security specialists.
- Establish application security governance, risk assessment frameworks, and measurable security KPIs.
- Collaborate with engineering and product leadership to integrate security into product development and release processes.

- Secure Software Development Life Cycle (SSDLC)Integrate security practices into every phase of the SDLC, from design and development to deployment and maintenance.
- Establish and enforce secure coding standards, threat modelling practices, and security architecture reviews.
- Implement and manage security testing processes, including Static Application Security Testing (SAST), Energetic Application Security Testing (DAST), Software Composition Analysis (SCA), and Interactive Application Security Testing (IAST).
- Drive adoption of DevSecOps practices and automated security controls within CI/CD pipelines.

- Vulnerability and Risk ManagementOversee application vulnerability assessments, penetration testing, and security code reviews.
- Prioritize vulnerabilities based on severity, exploitability, business impact, and risk exposure.
- Coordinate remediation activities with development teams and track vulnerabilities through closure.
- Manage security exceptions,



risk acceptance, and mitigation plans.
- Lead root-cause analysis for application security incidents and recurring vulnerabilities.

- Security Architecture and Technical GuidanceReview application architectures, APIs, microservices, and cloud-native solutions for security risks.
- Guide teams on authentication, authorization, encryption, secrets management, and secure session management.
- Ensure protection against common application vulnerabilities, including those identified in the OWASP Top 10 and OWASP API Security Top 10.
- Promote secure design principles, including least privilege, defense in depth, and zero-trust security where applicable.
- Evaluate security tools, technologies, and frameworks to improve application security capabilities.

- Compliance and Security GovernanceEnsure application security practices align with relevant standards and frameworks, such as OWASP ASVS, NIST, ISO 27001, and SOC 2.
- Support compliance assessments, internal and external audits, and customer security reviews.
- Maintain application security documentation, policies, risk registers, and audit evidence.
- Where applicable, support privacy and security requirements relevant to healthcare data, including HIPAA.

- Stakeholder Management and AwarenessPartner with engineering, DevOps, cloud, infrastructure, product management, and enterprise security teams.
- Conduct secure coding training and application security awareness programs for developers.
- Communicate application security risks, remediation priorities, and program performance to senior management.
- Build a security-first culture across engineering and product teams.





- QualificationsBachelor's or Master's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- 12–15 years of experience in information security, application security, software security engineering, or cybersecurity.
- At least 3–5 years of experience leading application security teams or programs.
- Strong understanding of secure SDLC, DevSecOps, threat modelling, and security architecture.
- Hands-on experience with application security testing tools such as SAST, DAST, SCA, and API security testing solutions.
- Experience with vulnerability management, penetration testing, secure code reviews, and remediation tracking.
- Strong knowledge of web application security, REST APIs, microservices, authentication, authorization, and encryption.
- Experience securing cloud-based applications and integrating security controls into CI/CD pipelines.
- Understanding of security compliance frameworks, risk management, and audit processes.
- Excellent leadership, communication, stakeholder management, and problem-solving skills.

- Preferred Technical SkillsSecurity frameworks: OWASP Top 10, OWASP ASVS, OWASP API Security Top 10, NIST.
- Security testing tools: Checkmarx, Veracode, Fortify, SonarQube, Burp Suite, Snyk, or equivalent tools.
- Cloud security: AWS, Microsoft Azure, or Google Cloud Platform.
- DevSecOps: Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps, and automated security scanning.
- Application technologies: Java, .NET, Python, JavaScript, REST APIs, microservices, and containerized applications.
- Security practices: Threat modelling, penetration testing, secure code review, secrets management, and vulnerability remediation.

- Preferred CertificationsCISSP – Certified Information Systems Security Professional
- CSSLP – Certified Secure Software Lifecycle Professional
- CEH – Certified Ethical Hacker
- OSCP – Offensive Security Certified Professional
- GIAC certifications relevant to application security

📌 Application Security Engineer (Bengaluru)
🏢 ZeOmega
📍 Bengaluru