Lead Assistant Manager - Application Security

Jobtailor; Dadri; On-site; INR 800,000 - 1,200,000; Full time

Job summary

EXL is hiring for a position focused on Application Security Testing in India. The role involves conducting penetration testing, performing security assessments for both web and mobile applications, and integrating security tools within CI/CD workflows.

The successful candidate will assist in vulnerability management and promote secure coding standards while engaging with development teams to enhance their security practices.

Qualifications

• Experience in web application penetration testing, mobile application assessments, and source code reviews.
• Knowledge of security tools and practices in CI/CD environments.
• Ability to produce reports and assist in vulnerability remediation.

Responsibilities

• Conduct manual and tool-assisted web application penetration testing.
• Integrate security tools within CI/CD pipelines.
• Triage and track vulnerabilities through their lifecycle.
• Assist in threat modeling and secure design reviews.

Job description

Key Responsibilities

Application Security Testing

• Conduct manual and tool-assisted web application penetration testing (OWASP Top 10, business logic flaws, API vulnerabilities).
• Perform mobile application security assessments for Android and iOS (static & dynamic analysis, reverse engineering, OWASP MASVS/MSTG).
• Execute source code security reviews—both SAST-assisted and manual—across languages such as Java, Python, JavaScript/TypeScript, and others.
• Participate in grey-box assessments and targeted red‑team exercises against internal and client‑facing applications.

DevSecOps Integration

• Integrate and operate SAST, DAST, SCA, and container security tools within CI/CD pipelines (Jenkins, GitHub Actions).
• Configure and tune security tooling to reduce false positives and enforce actionable pipeline quality gates.
• Support IaC security reviews (Terraform, CloudFormation) and secrets management practices.
• Collaborate with platform engineering to embed security controls in build and deployment workflows.

Vulnerability Management & Remediation

• Triage, prioritise, and track vulnerabilities from discovery through verified closure.
• Produce clear, developer-friendly reports with reproducibility steps, severity ratings, and remediation guidance.
• Support development teams in understanding and fixing identified issues; re‑test post‑remediation.
• Maintain internal vulnerability registers and risk‑tracking artefacts.

Secure SDLC

• Assist in threat modelling and secure design reviews for new features and services.
• Promote secure coding standards and OWASP best practices across development teams.
• Contribute to security champions programmes and developer awareness initiatives.
• Assist in securing AI/GenAI applications and APIs following defined security patterns.