The Global Application Security & DevSecOps Leadis responsible for,operatingand continuously improving the organisation's application security function across the complete software development lifecycle.
The role owns the policies, technical standards, engineering controls, security testing services, Azure DevOps integrations, application securityplatformsand governance processesrequiredto ensure that internally developed and externally supplied applications are designed, built,testedand released securely.
The role holder must be capable of defining the global AppSec strategy while also configuring, integrating,operating,troubleshootingand improving the underlying security tools.
The role will embed automated and risk-based security controls into Azure DevOps repositories and CI/CD pipelines at enterprise scale, covering potentially hundreds of Azure DevOps projects and thousands of repositories.
The role is accountable for ensuring that security controls are:
Proportionate to application risk.
Maintain the global Application Security and DevSecOps strategy.
Define the division of responsibilities between AppSec, engineering, cloud security, architecture, SOC, vulnerability management,riskand compliance.
Develop a risk-based AppSec control framework for different application types and criticality levels.
Establish minimum security requirements for internally developed, externally developed and SaaS applications.

Data classification.
Regulatory impact.
Use of AI or autonomous functionality.
Produce executive-level risk reporting for the CISO and technology leadership.
Represent Application Security at architecture,engineeringand risk governance forums.

API security testing.
Mobile security testing.




Pipeline security assessment.
Secure Azure DevOps configuration.
Penetration-test scoping and coordination.
Developer security training.
Security Champions support.
Supplier application security review.
Application incident root-cause analysis.

Define mandatory security activities for each SDLC stage.
Establish security acceptance criteria for epics,featuresand user stories.
Develop risk-based security release gates.
Ensure emergency-release procedures include proportionate security checks and retrospective review.
Define criteria for when applications require manual review or penetration testing.
Secure software development lifecycle governance.
Secure coding standards.
Static application security testing.
Software composition analysis.
Dynamic application security testing.
Interactive application security testing,
Manual secure code review.
Application penetration testing.
API security testing.
Cloud-native and serverless application security.
Container and application image security during build.
Infrastructure-as-code security within application delivery pipelines.
Software supply-chain security.
Azure DevOps repository and pipeline security.
Application security tool ownership and operation.
Security Champions and developer enablement.
Application security exception and risk-acceptance processes.




Application security metrics,reportingand assurance.
Third-party and externally developed software assurance.
Security of AI-enabled applications and AI-generated code.
Product security incident support and root-cause analysis.

Network-device vulnerability management.
Cloud-host vulnerability remediation.
Runtime host and virtual-machine vulnerability management.
SOC monitoring and incident queue management.
Infrastructure penetration testing.

Definition of application-security remediation requirements.
Reporting on application-security exposure.
Escalation of overdue high-risk application findings.

Runtime host,nodeand deployed-container vulnerability management should remain with Cloud Security, Platform Security or Vulnerability Management, subject to a defined RACI.

Explore the rewards and benefits that help you thrive - at every stage of your life and your career.
Comprehensive life insurance coverage.
Premium medical insurance for you and your dependents.
Generous annual leave balance.
Flexible and hybrid work solutions.
Work from home opportunities outside of country.
Company gratuity scheme.
Discretionary bonus program.
Relocation assistance.
Employee Wellbeing Program: 24/7 access to specialists in finance, legal matters, family care, personal health, fitness, and nutrition.
We're , a world-class engineering services and nuclear organization. We connect people, data and technology to transform the world's infrastructure and energy systems. Together, with our industry partners and clients, and our global team of consultants, designers, engineers and project managers, we can change the world.

📌 DevOps Security Lead (Bengaluru)
🏢 SNC Lavalin Fayez Engineering
📍 Bengaluru