Job Description: Key Responsibilities

Application Security Testing

- Execute source code security reviews—both SAST-assisted and manual—across languages such as Java, Python, JavaScript/TypeScript, and others.

DevSecOps Integration

- Integrate and operate SAST, DAST, SCA, and container security tools within CI/CD pipelines (Jenkins, GitHub Actions).
- Configure and tune security tooling to reduce false positives and enforce actionable pipeline quality gates.
- Support IaC security reviews (Terraform, CloudFormation) and secrets management practices.
- Collaborate with platform engineering to embed security controls in build and deployment workflows.

Vulnerability Management & Remediation

- Triage, prioritise, and track vulnerabilities from discovery through verified closure.
- Produce clear, developer-friendly reports with reproducibility steps, severity ratings, and remediation guidance.
- Support development teams in understanding and fixing identified issues; re-test post-remediation.
- Maintain internal vulnerability registers and risk-tracking artefacts.

Secure SDLC

- Assist in threat modelling and secure design reviews for new features and services.
- Promote secure coding standards and OWASP best practices across development teams.
- Contribute to security champions programmes and developer awareness initiatives.

Responsibilities: Key Responsibilities

Application Security Testing

- Execute source code security reviews—both SAST-assisted and manual—across languages such as Java, Python, JavaScript/TypeScript, and others.

DevSecOps Integration

- Integrate and operate SAST, DAST, SCA, and container security tools within CI/CD pipelines (Jenkins, GitHub Actions).
- Configure and tune security tooling to reduce false positives and enforce actionable pipeline quality gates.
- Support IaC security reviews (Terraform, CloudFormation) and secrets management practices.




- Collaborate with platform engineering to embed security controls in build and deployment workflows.

Vulnerability Management & Remediation

- Triage, prioritise, and track vulnerabilities from discovery through verified closure.
- Produce clear, developer-friendly reports with reproducibility steps, severity ratings, and remediation guidance.
- Support development teams in understanding and fixing identified issues; re-test post-remediation.
- Maintain internal vulnerability registers and risk-tracking artefacts.

Secure SDLC

- Assist in threat modelling and secure design reviews for new features and services.
- Promote secure coding standards and OWASP best practices across development teams.
- Contribute to security champions programmes and developer awareness initiatives.
- Qualifications: Skills & Qualifications

Non-Negotiable - Must Have

- Practical source code review capability—ability to identify security defects through manual inspection and SAST tooling (Semgrep, SonarQube, Checkmarx, Veracode).
- Familiarity with DevSecOps pipelines and security tool integration (SAST/DAST/SCA in CI/CD).
- Solid understanding of vulnerability classes: injection, authentication flaws, IDOR, XXE, SSRF, deserialization, cryptographic weaknesses.
- Scripting/automation capability for security tasks (Python, Bash, or equivalent).

Good to Have

- Certifications: eWPTX (eLearnSecurity), OSCP (Offensive Security), CEH, GWEB, GWAPT, or equivalent offensive security credentials.
- Exposure to cloud security fundamentals (AWS/Azure/GCP—IAM, security groups, logging).
- Knowledge of AI/GenAI security risks (OWASP LLM Top 10, prompt injection, model abuse).
- Experience with API security testing (REST, GraphQL, gRPC).
- Familiarity with compliance frameworks: OWASP ASVS, NIST, ISO 27001, PCI-DSS.

Qualifications

- Bachelor’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
- Offensive security certifications (eWPTX, OSCP, GWAPT, CEH, or equivalent) are a robust plus.

📌 Lead Assistant Manager - Application Security (Noida)
🏢 EXL Service
📍 Noida