Application Security Analyst

dnA Consulting; Mysuru; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

dnA Consulting in India is seeking an experienced Application Security professional to advise development, DevOps, and engineering teams across the SDLC. You will lead secure coding reviews, threat modeling, and DevSecOps enablement to embed security by design in containerized and cloud-native apps.

You will mentor teams on OWASP Top 10, API security, authentication, and cryptography, while integrating automated testing into CI/CD and driving shift-left initiatives across the organization.

Qualifications

• 5+ years of experience in Application Security, DevSecOps, or related security functions.
• Strong understanding of Secure SDLC, DevSecOps methodologies, and application security best practices.
• Experience providing security guidance, consulting, mentoring, and training to software development teams.
• Strong proficiency in Java, Spring Boot, REST APIs, and modern application architectures.
• Hands-on experience with secure code reviews and application threat modeling.

Responsibilities

• Serve as the primary application security advisor to development, DevOps, and engineering teams.
• Provide security guidance during application design, development, testing, and deployment phases.
• Conduct secure code reviews for Java applications and services; review architectures and perform threat modeling.
• Establish and promote DevSecOps practices across development teams.
• Integrate security controls and automated security testing into CI/CD pipelines.
• Drive Shift Left Security initiatives and advocate secure-by-design development practices.
• Mentor developers on secure coding standards, OWASP Top 10, API Security, authentication, authorization, and cryptography.
• Develop and deliver secure coding training, workshops, and security awareness programs for software engineering teams.
• Support remediation efforts by helping development teams understand, prioritize, and resolve vulnerabilities.
• Analyze and validate findings from SAST, DAST, SCA, penetration tests, and vulnerability assessments.
• Collaborate with DevOps and cloud engineering teams to secure containerized and cloud-native applications.
• Assist with security incident investigations involving application-layer vulnerabilities.
• Act as a Security Champion and help establish security best practices throughout the engineering organization.

Skills

Application Security

DevSecOps

Threat Modeling

Secure SDLC

Mentoring

Java/Spring Boot

REST APIs

Cloud & Containers

Security Testing

Security Training

Tools

Semgrep

Trivy

SonarQube

Snyk

Veracode

Checkmarx

Job description

Role & responsibilities

• Serve as the primary application security advisor to development, DevOps, and engineering teams.


• Provide security guidance and consultation during application design, development, testing, and deployment phases.


• Conduct secure code reviews for Java applications and services. Review application architectures and perform threat modeling to identify potential security risks early in the SDLC.


• Establish and promote DevSecOps practices across development teams.


• Integrate security controls and automated security testing into CI/CD pipelines.


• Drive \"Shift Left Security\" initiatives and advocate secure-by-design development practices.


• Mentor developers on secure coding standards, OWASP Top 10, API Security, authentication, authorization, and cryptography.


• Develop and deliver secure coding training, workshops, and security awareness programs for software engineering teams.


• Support remediation efforts by helping development teams understand, prioritize, and resolve vulnerabilities.


• Analyze and validate findings from SAST, DAST, SCA, penetration tests, and vulnerability assessments.


• Collaborate with DevOps and cloud engineering teams to secure containerized and cloud-native applications.


• Assist with security incident investigations involving application-layer vulnerabilities.


• Act as a Security Champion and help establish security best practices throughout the engineering organization.

Preferred candidate profile

• 5+ years of experience in Application Security, DevSecOps, Secure Software Development, or related security functions.


• Strong understanding of Secure SDLC, DevSecOps methodologies, and application security best practices.


• Experience providing security guidance, consulting, mentoring, and training to software development teams.


• Strong proficiency in Java, Spring Boot, REST APIs, and modern application architectures.


• Hands-on experience with secure code reviews and application threat modeling.


• Experience with OWASP Top 10, CWE, Secure Design Principles, and Application Security Testing methodologies.


• Hands-on experience with security tools such as Semgrep, Trivy, SonarQube, Snyk, Veracode, Checkmarx, or similar solutions.