Lead - Security, GRC& Application Security

Role Summary

This role leads Pragma Edge's end-to-end security function - spanninggovernancecompliance, application security, cloud & infrastructuresecurity, threat monitoring, and external attack surface management. The Leadowns the security posture across internal systems, client-facing products, andcloudon-prem infrastructure, and is the primary point of accountability foraudit readiness, client TPRM responses, and remediation across every layer ofthe stack.

Core Responsibilities

1. Governance, Risk & Compliance (GRC)

- Own and maintain security policies (Access Control, Incident Response, Data Protection, SDLC) - review and update on a recurring cycle.

- Conduct risk assessments and client Third-Party Risk Management (TPRM) reviews; maintain and update the Vanta risk register and track remediation to closure.
- Map controls to ISO 27001, SOC 2, NIST, and OWASP standards.
- Own audit evidence collection - logs, screenshots, approvals - for both internal and external audits.
- Lead quarterly internal audits (client-specific) and HR audits; own annual external audit and ongoing Vanta compliance management. 2. Application Security & Secure Development

**- Perform secure code reviews on critical APIs and backend services.

- Own OWASP Top 10 remediation (BOLA, BFLA, Injection, Security Misconfigurations).
- Run Software Composition Analysis (SCA) - dependency vulnerability management, SBOM generation, license review, remediation validation.
- Own SAST scanning across JAR, Python,



and Maven artifacts using MendWhiteSource; own DAST scanning (web app + API) using OWASP ZAP and Burp Suite.
- Run containerimage vulnerability scanning (Mend CLI).
- Coordinate SASTDASTSCA findings with development teams, validate fixes, and perform rescans. 3. Penetration Testing

**- Build and execute pentesting plans for web applications, APIs, and products.

- Own client communication throughout pentest engagements, produce findings reports, and drive remediation to closure. 4. Cloud & Infrastructure Security

**- Review cloud IAM, network rules, and storage exposure; own security hardening (insecure configs, headers, TLS, secrets).

- Run infrastructure vulnerability assessments (Active Directory, switches, routers, internal servers) via Nessus.
- Run cloud compliance scans and client-specific AWS securitycompliance assessments via Nessus.
- Own network security review, configuration validation, and hardening recommendations.
- Manage on-prem security: installation requests, firewall changes, domain whitelisting, and inboundoutbound IP access control.
- Validate backup, restore, and DR readiness; improve audit logging and SIEM integration. 5. Threat Monitoring & Security Operations

**- Monitor security logs (Trend Micro)



and firewall logs (Sophos) - event review, traffic analysis, and investigation.

- Coordinate remediation with Infrastructure, Cloud, Networking, and Development teams; produce vulnerability reporting across infrastructure, cloud, application, and product layers. 6. External Attack Surface Management

**- Run weekly public IP discovery and maintain external asset inventory.

- Perform external reconnaissance, port scanning, and service enumeration.
- Own subdomain enumeration, takeover validation, and DNS verification.
- Run external vulnerability scanning and validation; monitor for exposed company-sensitive information on the internet. 7. Training, Awareness & Documentation

**- Run security awareness training and phishing simulations; run developer secure-coding sessions (OWASPAPI security).

- Prepare security assessments, training plans, test evaluations, and score analysis.
- Own compliance documentation: Access Change Requests, Device Disposal records, Incident Response documentation, Tabletop Exercise (TTE) documentation.
- Own security documentation: policies, assessment reports, remediation reports.
- Provide audit support: quarterly evidence, compliance reporting, vulnerability tracking, and exit-access revocation verification. **Requirements

Tools & Stack

Vanta (GRCcompliance), MendWhiteSource (SAST, SCA, container scanning),OWASP ZAP & Burp Suite (DAST), Nessus (infracloud vulnerabilityassessment), Trend Micro (log monitoring), Sophos (firewall monitoring).

📌 Security and GRC Specialist (Hyderabad)
🏢 Pragma Edge Software Services
📍 Hyderabad