Application Security Engineer - SSDLC

Reserve Bank Information Technology; Navi Mumbai; On-site; INR 1,400,000 - 2,400,000; Full time

Job summary

Reserve Bank Information Technology is seeking an Application Security Engineer in Navi Mumbai to join the Platform Software Security Services team. The role spans secure SDLC, API security, SAST/DAST/SCA, and threat modelling in a fast-paced environment.

Candidates should bring 3–8 years of experience, strong English communication, and the ability to collaborate with product owners and stakeholders. This is a fixed-term, full-time position located in Navi Mumbai and Bangalore.

Qualifications

• Experience in secure SDLC methodologies across Waterfall and Agile environments.
• Knowledge of OWASP and NIST security guidelines essential.
• Ability to review security in microservices, API security focus.
• Hands-on with source code reviews using SAST tools.
• Hands-on with DAST tests and vulnerability reporting.
• Hands-on with SCA and software composition analysis processes.
• Comfort with Agile development and collaboration with stakeholders.

Responsibilities

• Perform security best practices reviews with development teams.
• Execute SCA reviews and report vulnerabilities with fixes.
• Conduct Tech Stack reviews and document findings with recommendations.
• Perform code reviews with SAST tooling and report issues.
• Perform DAST on applications and report security issues.
• Support SSDLC tooling and contribute to RFP processes.

Skills

Secure SDLC

OWASP/NIST

API Security

SAST

DAST

SCA

Tech Stack Review

Agile

Cloud/VMware

Vulnerability Identification

Threat Modelling

Education

Bachelor's/Master in Engineering or CS/IT or Cyber Security specialization

Tools

SAST tools

DAST tools

SCA tools

Job description

Role: Application Security Engineer

Experience range: 3 years - 8 years

Reporting Structure

Reports to the Platform Software Security Services Lead/ Manager

Education

Bachelors Degree in Engineering/Master Degree in Engineering in CSE/CS/IT/IT Security or Cyber Security Specialization/B.Sc/M.Sc/MCA (IT/Computer) preferred

Experience/ Qualifications

1. Experience in the following process areas:

• Secure SDLC Methodologies for Waterfall/ Agile software development
• Should be well-versed with Security best practices like OWASP and NIST guidelines
• Ability to perform security review of microservices architecture, API Security
• Hands on experience on Source Code reviews - SAST solution
• Hands on experience on Dynamic Application Security Testing - DAST
• Hands on experience in Software Composition Analysis - SCA
• Hands on experience in performing Tech Stack Review
• Comfortable working in an environment that practices Agile development, engaging Product Owner and other stakeholders
• Good knowledge of Cloud platform/VMware
• Ability to identify vulnerabilities & threat actors in the application cycle and communicate effectively to the stake holders.
• Threat Modelling PASTA, STRIDE etc (Good to Have)

2. Possesses ability to quickly understand the technical and functional aspects of the project to be able to communicate effectively with different stakeholders.

3. Excellent written and verbal communication skills in English, high integrity, strong work ethic and ability to empathize with the customer.

4. Ability to work effectively in a fast-paced, project-oriented environment

5. Ability to prioritize and execute tasks

6. Ability to handle sensitive and confidential information

7. Strong analytical and problem-solving skills

Responsibilities

1. Perform security best practices review followed by Development team
2. Perform SCA and report vulnerabilities and recommendations
3. Perform Tech Stack review and report findings along with recommendations.
4. Perform code review (supporting SAST Tool) and remove false positives if any, and report valid security issues to development team
5. Perform DAST on the various applications and remove false positives if any, and report valid security issues to development team
6. Contribution to RFP process and assist in Implementing SSDLC Tools.

7. Escalate issues and risks and proactively takes ownership for resolution

8. Track milestones and deliverables and provide regular status reporting to respective stakeholders

Certifications

CSSLP/CISSP/SSCP or equivalent certification are desirable (Good to Have).

Application/API Security Threat Modelling/API Security product Implementations, Specialization or OWASP certifications or Agile Certifications are a plus

Employment Type

All positions are on fixed term contract on a full-time basis exclusively for ReBIT, initially for a period of five years, extendable by mutual consent

Location

Navi Mumbai, Bangalore