Cyber Security Consultant

Infosys; Bengaluru; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

Infosys Bengaluru is seeking a Cyber Security Consultant with 5–7 years of hands-on experience in application security and vulnerability management. You will conduct SAST, DAST, SCA, and manual code reviews, validate findings, and drive remediation with stakeholders.

The role requires strong Burp Suite, Fortify, Checkmarx, and cloud security experience, plus dashboards in Power BI to communicate risk to technical and non-technical audiences.

Qualifications

• Bachelor’s degree in information technology, Cybersecurity, Computer Science, or related discipline.
• 5-7 years of relevant experience in application security and/or vulnerability management.
• Solid understanding of OWASP Top 10 and secure architecture principles.
• Proficiency in Burp Suite for manual security testing and validation of findings.
• Hands-on experience with Fortify, Checkmarx, SonarQube, Black Duck, Tenable; familiarity with Nmap.
• Familiarity with NIST, MITRE ATT&CK, CIS benchmarks.
• Programming/scripting in Python, Java, .NET or similar.
• Excellent documentation, communication, and stakeholder engagement skills.
• Certifications such as Security+, SSCP, GWAPT; pursuing CISSP/OSCP.
• Experience using ServiceNow for vulnerability or incident tracking; Azure cloud and Azure DevOps.
• Power BI or similar tools for vulnerability metrics visualization.

Responsibilities

• Execute and support application vulnerability assessments (SAST, DAST, SCA, and manual code review).
• Validate scanner results, analyze false positives, and track remediation until verified fixes.
• Manage multiple application security initiatives with strict timelines in a fast-paced environment.
• Prioritize vulnerabilities based on business impact, exploitability, exposure, and CVSS.
• Develop dashboards and reports tracking vulnerability metrics, SLAs, and MTTR.
• Support CI/CD integration of security scanning and vulnerability workflows.
• Facilitate remediation planning with actionable recommendations and root cause analysis.
• Support threat modeling and application risk assessments; identify insecure design patterns.
• Participate in high-severity or zero-day remediation activities as needed.
• Provide input into policies and standards for application and cloud security controls.

Job description

Cyber Security Consultant

• Bachelor’s degree in information technology, Cybersecurity, Computer Science, or related discipline—or equivalent professional experience.
• 5-7 years of relevant experience in application security and/or vulnerability management.
• Solid understanding of common vulnerability classes (e.g., OWASP Top 10) and secure architecture principles.
• Proficiency in using Burp Suite for manual security testing of web applications and APIs, including validation of automated findings and identification of complex authentication, authorization, and business‑logic vulnerabilities.
• Hands‑on experience with tools such as Burp Suite, Fortify, Checkmarx, SonarQube, Black Duck, Tenable, and common network discovery tools (e.g., Nmap).
• Familiarity with NIST, MITRE ATT&CK, and CIS benchmarks.
• Programming/scripting proficiency in languages such as Python, Java, .NET, or similar.
• Excellent documentation, communication, and stakeholder engagement skills.
• Professional certifications (e.g., Security+, SSCP, GWAPT, or pursuing CISSP, OSCP).
• Experience using the ServiceNow platform for vulnerability or incident tracking.
• Proficiency in Azure cloud and Azure DevOps environments.
• Experience using Power BI or similar tools to visualize vulnerability metrics and remediation trends for technical and non-technical stakeholders.

Responsibilities

• Execute and support application vulnerability assessments (SAST, DAST, SCA, and manual code review), ensuring findings are accurate, actionable, and relevant to application risk.
• Validate scanner results, perform false‑positive analysis, and track findings through remediation, including retesting to confirm effective fixes.
• Manage multiple application security initiatives concurrently while meeting strict timelines in a fast paced environment.
• Prioritize vulnerabilities based on business impact, exploitability, exposure, and likelihood, using industry best practices (e.g., CVSS scoring).
• Develop and maintain dashboards and reports tracking vulnerability metrics such as severity distribution, remediation SLAs, and mean time to remediation (MTTR).
• Support the integration of security scanning and vulnerability workflows into CI/CD pipelines, leveraging existing tooling and automation.
• Facilitate remediation planning by providing actionable recommendations and coordinating root cause analysis.
• Support threat modeling and application risk assessments, with a focus on discovering insecure design patterns.
• Participate in high‑severity or zero‑day vulnerability response activities, including impact analysis and coordinated remediation efforts, as needed.
• Provide input into policies and standards related to application and cloud security controls.