About the Platform The Digital Office Platform is a multi-tenant, configuration-driven government case-management platform that lets many independent government bodies each configure their own case lifecycle
• data model, intake forms, versioned workflows, roles, SLAs, notifications, audit and reporting
• and run real cases end-to-end without custom code per tenant. It is built as ~20 independent Spring Boot microservices (engines), each owning its own PostgreSQL database, coordinated behind a Next.js web application, and deployed hosting-agnostic on sovereign / government cloud using open-source components. Tenant isolation is by tenant_id; published workflow versions are immutable and live cases pin to their version; security and data boundaries fail closed. Role and Responsibilities
• Threat-model the platform end-to-end and review the secure design of multi-tenancy (tenant_id isolation and bound tenant predicates), the deny-by-default / fail-closed security filters, and the separated three
- key trust model (fleet JWT secret, platform-admin signing key, internal-service key — kept distinct and never merged).
• Conduct secure code review sacross the Java / Spring engines and the Next.js application
• covering authentication (BCrypt password hashing, lockout, session limits, token lifecycle), authorization (RBAC /ABAC / policy), input validation, injection prevention (allow-listed identifiers, parameterised queries) and secret handling (AES-256-GCM at rest) — and drive remediation to closure.




• Plan and coordinate VAPT / penetration testing and vulnerability assessments across the fleet and the web / API surface; triage SAST / DAST / SCA findings, assign severities and track fixes.
• Own DPDP (Act 2023 / Rules 2025) compliance review — data-flow and data-inventory mapping, consent, retention, data-minimisation and cross-tenant data-isolation controls
• and the immutable audit trail (append-only store, SHA-256 integrity, field-level diff).
• Review and advise on the documented residual hardening items (e.g. RS256 / JWKS token hardening and token revocation, platform MFA) and verify closure as they are addressed; define the secure-coding and security-testing standards the team follows.
• Prepare security evidence and documentation for STQC clearance and government security audit, and support incident response for security events. Qualifications and Experiences Bachelor's degree in any discipline with 5+ years of experience in application security/ secure software development. Required Skill Set
• Robust knowledge of OWASPTop 10, securecoding in Java / Spring,JWT / token security, and session / credential security.
• Experience in multi-tenant data-isolation review and in handling web / API security audits and their tools.
• Experience planningand coordinating VAPT / penetration testing and using SAST / DAST / SCA tooling.
• Working knowledge of DPDP Act 2023 / Rules 2025, GIGW and STQC requirements, and of cryptographic controls (hashing, authenticated encryption, key management).

📌 Application Security (Noida)
🏢 Digital India
📍 Noida