Asst Dir (Application Security Testing)DevOps Engineer

Moody's Corporation; Bengaluru; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Moody's Corporation in Bengaluru is seeking an Asst Dir (Application Security Testing) DevOps Engineer to lead security testing across infrastructure, containers, and code. You will run continuous scanning and drive risk-based remediation across platforms in a fast-paced environment.

The role requires 6+ years in security engineering/DevSecOps, with CISSP/CCSP or cloud security certifications preferred. You will collaborate with audit and compliance teams, maintain SBOMs, and produce audit-ready

Qualifications

• 6+ years of experience in security engineering, cloud security, or DevSecOps.
• Experience leading vulnerability management programs with risk-based prioritization.
• Hands-on security scanning across infra, containers, dependencies, and source code.
• Experience partnering with audit and compliance teams to align evidence with control requirements.
• Strong written communication to develop technical docs and audit-ready evidence.
• CISSP, CCSP, cloud security certs preferred and security tooling experience.

Responsibilities

• Run continuous security scanning across infrastructure, containers, dependencies, and code.
• Prioritize vulnerabilities based on exploitability and impact rather than scores alone.
• Track remediation timelines and document security exceptions and mitigating controls.
• Build automated checks to validate security status using live-system data.
• Prepare technical evidence and responses for assessors and reviewers for significant changes.
• Partner with compliance teams to maintain alignment between evidence, documentation, and controls.
• Maintain SBOMs and supply-chain security controls.
• Lead secure design review sessions to identify security risks.
• Investigate and respond to suspicious activity alerts.
• Tune security detections to reduce noise and improve coverage.

Skills

Security engineering

DevSecOps

Vulnerability management

Security scanning

Audit & compliance collaboration

Technical documentation

Education

Bachelor's degree in CS / Information Security

Job description

Let's begin! Asst Dir (Application Security Testing)DevOps Engineer (14941)

At Moody's, we unite the brightest minds to turn today’s risks into tomorrow’s opportunities. We do this by striving to create an inclusive environment where everyone feels welcome to be who they are—with the freedom to exchange ideas, think innovatively, and listen to each other and customers in meaningful ways. Moody’s is transforming how the world sees risk. As a global leader in ratings and integrated risk assessment, we’re advancing AI to move from insight to action—enabling intelligence that not only understands complexity but responds to it. We decode risk to unlock opportunity, helping our clients navigate uncertainty with clarity, speed, and confidence.

Skills and Competencies

• 6+ years of experience in security engineering, cloud security, or Development, Security and Operations (DevSecOps), with the ability to independently address complex security challenges.
• Experience leading vulnerability management programs and applying risk-based prioritization to focus remediation on the most meaningful security findings.
• Hands-on experience with security scanning across infrastructure, containers, software dependencies, and source code.
• Experience partnering with audit and compliance teams to align technical evidence with security control requirements.
• Strong written communication skills, including the ability to develop clear technical documentation and audit-ready evidence for assessors.
• Prior security compliance experience is required. Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), cloud security certifications, and experience with security tooling and detection engineering are preferred.

Education

Bachelor’s degree in computer science, Information Security, or a related field, or equivalent practical experience.

Responsibilities

• Run continuous security scanning across infrastructure, containers, dependencies, and code.
• Prioritize vulnerabilities based on exploitability, reachability, and potential impact rather than severity scores alone.
• Track remediation timelines and document security exceptions and mitigating controls.
• Build automated checks to validate security status using live-system data.
• Prepare technical evidence and responses for assessors and reviewers, including support for significant change notifications.
• Partner with compliance teams to maintain alignment between technical evidence, documentation, and control requirements.
• Maintain Software Bills of Materials (SBOMs) and associated software supply-chain security controls.
• Lead secure design review sessions to identify and address security risks.
• Investigate and respond to suspicious activity alerts.
• Tune security detections to reduce noise and improve meaningful coverage.

About the Team

Our Banking Risk team is responsible for protecting Moody’s systems and data and demonstrating the effectiveness of our security controls.

Moody’s is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, protected veteran status, sexual orientation, gender expression, gender identity or any other characteristic protected by law.
Candidates for Moody's Corporation may be asked to disclose securities holdings pursuant to Moody’s Policy for Securities Trading and the requirements of the position. Employment is contingent upon compliance with the Policy, including remediation of positions in those holdings as necessary.