Lead - Application Security SSDLC

Rebit; Navi Mumbai; On-site; INR 2,500,000 - 4,000,000; Full time

Job summary

ReBIT is seeking an experienced information security professional in Navi Mumbai to lead SSDLC risk assessments, enforce security controls across lifecycle, and develop security standards for agile development. You will coordinate with project teams and prepare management reports on security effectiveness.

Ideal candidates possess 6+ years in information security, hands-on SAST/DAST/IAST, threat modelling, and familiarity with OWASP/NIST best practices, to help secure RBI-related applications.

Qualifications

• 6+ years of information security background is essential.
• 4+ years of SDLC security reviews in project lifecycle.
• Experience evaluating control environment through architecture/design reviews.
• Hands-on security reviews of design flaws.
• Hands-on SAST/DAST/IAST and threat modelling experience.
• Familiar with OWASP, SANS, ISACA, GAO, FISCAM, NSA, NIST, IETF best practices.
• Develop a security framework to be followed by developers across the SDLC.
• Experience with security analysis tools like SAST, DAST, SCA, IAST, RASP, threat modelling.

Responsibilities

• Conduct internal/third-party SSDLC risk assessments on business-critical assets.
• Coordinate with project teams to enforce security framework in all SSDLC phases.
• Prepare security effectiveness reports for management.
• Test applications/systems for SSDLC framework to RBI/ReBIT security practices.
• Ensure new applications are inducted into data centre after SSDLC assessments.
• Follow up on closure of gaps and escalate when necessary.
• Define and enhance application security requirements for agile development.
• Assist DevSecOps to create secure CI/CD pipeline processes.

Skills

Information Security

Secure SDLC

Threat Modelling

SAST/DAST/IAST

RASP

Security Tooling

OWASP/NIST

CI/CD Security

Education

University degree in computer science or IT

Tools

SAST tools

DAST tools

SCA tools

IAST tools

RASP tools

Threat Modelling tools

Job description

University degree in the field of computer science or IT.

Experience/ Qualifications

• 6+ years ofInformation Security background is essential.
• 4+ years of Software Development Lifecycle, Security reviews inproject lifecycle
• Experience in evaluating the control environment through Architecture,Software Design reviews and or not limited to Threat Modelling.
• Security reviews of design flaws
• Hands on experience in Static Application Security Testing and DynamicApplication Security Testing.
• Experience in standardizing application security tools and methodology
• Should be familiar with the best practices of OWASP, SANS Institute,ISACA, GAO, FISCAM, NSA, NIST, Internet Engineering Task Force (IETF)
• Develop a detailed security framework to be followed by developers inevery steps of software development lifecycle.
• Experience insoftware/application analysis tools like SAST, DAST, SCA, IAST, RASP, threatmodelling, etc.

Information technology

Responsibilities

• Conduct internal /third-party Security (SSDLC) Risk Assessments on business-critical assets andprocesses.
• Coordinate with project teams for ensuring security framework to enforcedin all phases of SSDLC
• Prepare security effectiveness reports for management.
• Testing theapplications / systems for SSDLC framework to RBI / ReBIT InformationSecurity practices
• Ensure newapplications are inducted into Data centre after conducting SSDLC assessments
• Follow up on closure of these gaps and escalat when necessary
• Define and enhance application security requirements and standardswhich must be designed for agile development methods leveraging traditionalapplication architectures
• Assist DevSecOPsteam to create secure predictable CI/CD pipeline processes, and enableapplication teams to develop new capabilities securely

Certifications (any two)

• CISSP
• CSSLP
• Certificates relatedto cloud security
• Certificates relatedto DevSecOps automation