Application Security Lead

Symphoni HR Pvt Ltd.; Mumbai; On-site; INR 4,000,000 - 6,500,000; Full time

Job summary

Symphoni HR Pvt Ltd. in Mumbai seeks an experienced Senior Cybersecurity Architect with 9–10 years in the field to lead security architecture assessments and secure-by-design implementations across enterprise systems.

You will apply threat modeling, OWASP practices, and robust cryptography standards, review secure coding, and oversee SBOM and container security within cloud-native environments.

Qualifications

• 9–10 years of hands-on cybersecurity experience.
• Proven experience in security architecture assessments and secure-by-design implementations.
• Experience with enterprise security frameworks and methodologies.
• Deep understanding of security architecture principles and frameworks.
• Proficiency in threat modeling methodologies (STRIDE, PASTA).
• Deep, hands-on knowledge of the OWASP Top 10, OWASP ASVS, and OWASP SAMP/SAMM maturity practices.
• Strong understanding of secure coding practices across common stacks (Java, .NET, Python, JavaScript/Node.js) and the ability to review code for security defects.
• Expertise in API security, including OAuth 2.0, OpenID Connect, and secure token handling.
• Familiarity with authentication/authorization protocols, secrets management, and cryptographic best practices at the application layer.
• Experience with software supply‑chain security, dependency/vulnerability management, and SBOM practices.
• Knowledge of container and cloud‑native application security (image scanning, runtime protection, secure configuration).
• Knowledge of security controls and standards (NIST, ISO 27001, CIS Controls)

Skills

Security architecture

Threat modeling (STRIDE, PASTA)

OWASP Top 10/ASVS/SAMM

Secure coding practices (Java/.NET/PY/

API security (OAuth 2.0, OpenID)

Authentication/Authorization protocols

Secrets management

Cryptography best practices

SBOM practices

Container & cloud-native security

Security controls (NIST/ISO 27001/CIS)

Job description

Must have 9-10 years of hands-on experience in cybersecurity domain.

• Proven experience in security architecture assessments and secure-by-design implementations.
• Experience with enterprise security frameworks and methodologies.
• Deep understanding of security architecture principles and frameworks
• Proficiency in threat modeling methodologies (STRIDE, PASTA)
• Deep, hands‑on knowledge of the OWASP Top 10, OWASP ASVS, and OWASP SAMP/SAMM maturity practices.
• Strong understanding of secure coding practices across common stacks (e.g., Java, .NET, Python, JavaScript/Node.js) and the ability to review code for security defects.
• Expertise in API security, including OAuth 2.0, OpenID Connect, and secure token handling.
• Familiarity with authentication/authorization protocols, secrets management, and cryptographic best practices at the application layer.
• Experience with software supply‑chain security, dependency/vulnerability management, and SBOM practices.
• Knowledge of container and cloud‑native application security (image scanning, runtime protection, secure configuration).
• Knowledge of security controls and standards (NIST, ISO 27001, CIS Controls)