Description

Senior Cybersecurity Lead to own security process and governance across the SDLC for engineering teams in Chennai and the US. Working with the Principal Security Engineer you will define and maintain the security processes and controls our engineering teams follow across our cloud platforms. You will embed Secure SDLC/DevSecOps run penetration testing and vulnerability management partner with the AI team to secure and govern AI-enabled capabilities and lead security culture audit readiness and incident management. You will also report security risk to engineering and business leaders.

What Youll Do

Youll own the process and governance for cybersecurity within the SDLC focused on three core priorities:

- Embedding security into the SDLC. Partner with the Engineering team on design reviews CI/CD testing penetration testing and vulnerability management.
- Securing and governing AI. Partner with the AI team to set the security and governance guardrails for AI/LLM-enabled features and AI-assisted development in Platform Services.
- Driving security culture and governance. Make security part of the definition of done for engineering and AI teams in Chennai and the US; lead ISO 27001 / SOC 2 audit readiness; work with the Principal Security Engineer on incident management.

Embed security into the SDLC

- Define and maintain Secure SDLC / DevSecOps processes security controls and review gates with engineering across internal and cloud-based apps.
- Integrate security testing and automation into CI/CD with Engineering and DevOps; define testing requirements and roll out secure-coding practices and tooling.
- Ensure architecture/design reviews and threat modelling happen early in delivery; work with the Principal Security Engineer to address identified risks.
- Institute cloud security review processes for AWS and/or Azure: ensure IAM network logging encryption and CI/CD security are reviewed with the relevant technical teams.
- Own the penetration testing process for web API cloud and infrastructure: coordinate scoping testing reporting remediation tracking and retesting.
- Run the vulnerability management process with risk-based prioritization (exploitability exposure impact asset criticality); coordinate remediation with engineering and track findings to closure.

Secure and govern AI

In partnership with the AI team:





- Set AI security policy and minimum controls for AI-enabled products and AI-assisted development (least privilege tool allowlists data-loss controls input/output validation).
- Identify and track AI risks: data and code leakage prompt injection unsafe output over-permissioned agents model/supply-chain and IP/licensing.
- Define oversight standards for AI agents: autonomy limits when human approval is required auditability and AI incident escalation.
- Align with ISO/IEC 42001 and NIST AI RMF; provide evidence for audits and customer assurance.

Drive security culture and governance

- Run security awareness and secure-coding training for engineering teams in Chennai and the US.
- Mentor engineers on secure practices; coordinate with Engineering AI DevOps Architecture and Product on adoption.
- Support ISO 27001 / SOC 2 controls and audits; use security metrics and reporting to track adoption and improve processes.
- Partner with the Principal Security Engineer on security incident management: defining escalation paths coordinating response and leading post-incident reviews.

Responsibilities

- Flexible work arrangements for better work-life balance
- Generous Paid Leaves (Annual Sick Compassionate Local Public Marriage Maternity Paternity Medical leave)
- Medical benefits ( Insurance and Annual Health Check-up)
- Pension and Insurance Policies (Group Term Life Insurance Group Personal Accident Insurance Travel Insurance)
- Training and Development Assistance (Training Sponsorship On-The-Job Training Training Programme)
- Additional Benefits (Long Service Awards Mobile Phone Reimbursement)
- Company bonus/Profit share.

*Benefits may vary based on position tenure/contract/grade level*

DNV is an Equal Chance Employer and gives consideration for employment to qualified applicants without regard to gender religion race national or ethnic origin cultural background social group disability sexual orientation gender identity marital status age or political opinion. Diversity is fundamental to our culture and we invite you to be part of this diversity.

Qualifications





Must Have Experience

- 810 years in cybersecurity with a strong application security background.
- Solid understanding of web and API security (OWASP Top 10 OWASP API Security Top 10).
- Led penetration testing and vulnerability management programs end-to-end: scoping risk-based prioritization remediation tracking and retesting.
- Built or matured Secure SDLC / DevSecOps processes including SAST SCA DAST secrets scanning and review/merge gates in CI/CD.
- Experience running or participating in threat modelling as part of delivery.
- Familiarity with software supply-chain security (SBOM build integrity).
- AWS and/or Azure security including IAM network logging encryption and cloud security controls and review processes.
- Strong understanding of incident response and incident management.
- Experience with managed security services and security operations.
- Working knowledge of security governance and compliance frameworks (ISO 27001 SOC 2) including control design audit evidence and security metrics.
- Working knowledge of AI/LLM security risks (e.g. prompt injection data leakage over-permissioned agents) and the OWASP LLM Top 10.
- Strong communication stakeholder management and leadership; proven ability to get security practices adopted across teams without direct authority.

Preferred

- SaaS product or cloud-based environment experience; security automation.
- Experience securing AI/LLM-enabled applications or establishing AI governance (e.g. ISO/IEC 42001 NIST AI RMF).
- Established a threat modelling practice across teams: standard methodology (e.g. STRIDE) templates and review cadence.
- Implemented software supply-chain controls: SBOM management artifact signing and provenance (e.g. SLSA).
- Managed MSSP/MDR relationships: SLAs escalation and integration with internal incident processes.
- Certifications: CISSP CISM or CRISC; ISO 27001 Lead Implementer/Auditor a plus.

Education

Bachelors or Masters in Computer Science Cybersecurity IT Engineering or related or equivalent experience plus recognized certifications.

Security and compliance with statutory requirements in the countries in which we operate is essential for DNV. Background checks will be conducted on all final candidates as part of the offer process in accordance with applicable country-specific laws and practices.

Required Experience:

Senior IC

📌 Senior Cybersecurity Lead – DevSecOps and Governance (Chennai)
🏢 DNV
📍 Chennai