About the Platform The Digital Office Platform is a multi-tenant, configuration-driven government case-management platform that lets many independent government bodies each configure their own case lifecycle

- data model, intake forms, versioned workflows, roles, SLAs, notifications, audit and reporting
- and run real cases end-to-end without custom code per tenant. It is built as ~20 independent Spring Boot microservices (engines), each owning its own PostgreSQL database, coordinated behind a Next.js web application, and deployed hosting-agnostic on sovereign

/ government cloud using open-source components. Tenant isolation is by tenant_id; published workflow versions are immutable and live cases pin to their version; security and data boundaries fail closed.

Role and Responsibilities

1. Threat-model the platform end-to-end and review the secure design of multi-tenancy (tenant_id isolation and bound tenant predicates), the deny-by-default / fail-closed security filters, and the separated three- key trust model (fleet JWT secret, platform-admin signing key, internal-service key — kept distinct and never merged).
2. Conduct secure code review sacross the Java / Spring engines and the Next.js application

- covering authentication (BCrypt password hashing, lockout, session limits, token lifecycle), authorization (RBAC /ABAC / policy), input validation, injection prevention (allow-listed identifiers, parameterised queries) and secret handling (AES-256-GCM at rest) — and drive remediation to closure.

1.



Plan and coordinate VAPT / penetration testing and vulnerability assessments across the fleet and the web

/ API surface; triage SAST / DAST / SCA findings, assign severities and track fixes.
1. Own DPDP (Act 2023 / Rules 2025) compliance review — data-flow and data-inventory mapping, consent, retention, data-minimisation and cross-tenant data-isolation controls

- and the immutable audit trail (append-only store, SHA-256 integrity, field-level diff).

1. Review and advise on the documented residual hardening items (e.g.

RS256 / JWKS token hardening and token revocation, platform MFA) and verify closure as they are addressed; define the secure-coding and security-testing standards the team follows.

2. Prepare security evidence and documentation for STQC clearance and government security audit, and support incident response for security events.

Qualifications and Experiences Bachelor's degree in any discipline with 5+ years of experience in application security/ secure software development.

Required Skill Set

1. Solid knowledge of OWASPTop 10, securecoding in Java / Spring,JWT / token security, and session / credential security.
2. Experience in multi-tenant data-isolation review and in handling web / API security audits and their tools.
3. Experience planningand coordinating VAPT / penetration testing and using SAST / DAST / SCA tooling.
4. Working knowledge of DPDP Act 2023 / Rules 2025, GIGW and STQC requirements, and of cryptographic controls (hashing, authenticated encryption, key management).

📌 Application Security (AppSec) Specialist (Noida)
🏢 Digital India
📍 Noida