Cybersecurity Subject Matter Expert (SME)

Sunovaa Tech; Pune District; On-site; INR 2,400,000 - 4,200,000; Full time

Job summary

Sunovaa Tech in Pune seeks a hands-on Cybersecurity SME to lead threat modeling, TRA, and security assessments across products, apps, and cloud services.

You will drive Secure SDLC, implement SAST/DAST/SCA and SBOM practices, guide container security with Docker/Kubernetes, and ensure compliance with OWASP, NIST, ISO 27001/27002.

This role emphasizes individual contributor ownership with cross-team collaboration and healthcare/regulatory exposure is a plus.

Qualifications

• 8+ years in cybersecurity, application security, product security, cloud security or related areas.
• 5+ years in product security, application security or security architecture.
• Strong hands-on experience in threat modeling, TRA, security architecture and secure SDLC.
• Practical experience securing AWS and/or Azure cloud environments.
• Strong hands-on understanding of Docker, Containers and Kubernetes Security.
• Experience with SAST, DAST, SCA, SBOM and vulnerability management.
• Strong knowledge of OWASP Top 10, NIST and ISO 27001/27002.

Responsibilities

• Act as a hands-on cybersecurity SME for products, applications, cloud platforms and software services.
• Lead Threat Modeling, TRA and cybersecurity risk assessments.
• Perform security architecture and design reviews with design-by-design recommendations.
• Drive Secure SDLC/SSDLC and DevSecOps practices across software development teams.
• Guide implementation and governance of SAST, DAST, SCA, SBOM and security testing tools.
• Provide technical guidance on AWS/Azure Cloud Security and cloud-native app security.
• Assess and guide remediation of vulnerabilities across applications, cloud infrastructure and containers.
• Provide hands-on guidance on Docker and Kubernetes security, including RBAC, secrets, network policies, security contexts and container image security.
• Coordinate penetration testing and security assessments and track remediation to closure.
• Develop cybersecurity standards, secure baselines, procedures and technical guidelines.
• Support compliance with OWASP, NIST, ISO 27001/27002 and healthcare/medical-device cybersecurity standards.
• Work closely with Architecture, Engineering, DevOps, QA and Product teams to resolve security issues.
• Provide technical mentoring and act as a cybersecurity authority for distributed engineering teams.

Skills

Cybersecurity

Threat Modeling

TRA

Secure SDLC

DevSecOps

AWS Security

Azure Security

Docker Security

Kubernetes Security

SAST/DAST/SCA/SBOM

OWASP/NIST/ISO27001

Tools

SAST tools

DAST tools

SBOM tooling

Job description

Role & responsibilities

• Act as a hands-on Cybersecurity SME for products, applications, cloud platforms and software services.
• Lead Threat Modeling, Threat & Risk Assessment (TRA) and cybersecurity risk assessments.
• Perform security architecture and design reviews and provide security-by-design recommendations.
• Drive Secure SDLC / SSDLC and DevSecOps practices across software development teams.
• Guide implementation and governance of SAST, DAST, SCA, SBOM and security testing tools.
• Provide technical guidance on AWS/Azure Cloud Security and cloud-native application security.
• Assess and guide remediation of vulnerabilities across applications, cloud infrastructure and containers.
• Provide hands-on guidance on Docker and Kubernetes security, including RBAC, secrets, network policies, security contexts and container image security.
• Coordinate penetration testing and security assessments and track remediation to closure.
• Develop cybersecurity standards, secure baselines, procedures and technical guidelines.
• Support compliance with OWASP, NIST, ISO 27001/27002 and applicable healthcare/medical-device cybersecurity standards.
• Work closely with Architecture, Engineering, DevOps, QA and Product teams to resolve security issues.
• Provide technical mentoring and act as a cybersecurity authority for distributed engineering teams.

Preferred candidate profile

• 8+ years of experience in Cybersecurity, Application Security, Product Security, Cloud Security, Software Engineering or related areas.
• 5+ years of hands-on experience in Product Security, Application Security or Security Architecture.
• Strong hands-on experience in Threat Modeling, TRA, Security Architecture and Secure SDLC.
• Practical experience securing AWS and/or Azure cloud environments.
• Strong hands-on understanding of Docker, Containers and Kubernetes Security.
• Experience with SAST, DAST, SCA, SBOM and vulnerability management.
• Strong knowledge of OWASP Top 10, NIST and ISO 27001/27002.
• Demonstrated ability to independently analyze security problems, recommend controls and drive technical remediation.
• Strong Individual Contributor / hands-on technical ownership capability; this is not primarily a people-management role.
• Healthcare, medical-device or other regulated product cybersecurity experience is preferred.
• Certifications such as CISSP, CSSLP, CCSP, CEH, Azure Security Engineer or CKS are an advantage.
• Candidates with primarily SOC, GRC, IAM/PAM, vulnerability-management or managerial experience without strong Product/Application, Cloud and Container Security exposure may not be suitable.