Lead IT Security - Code Security Engineer

ERGO Technology & Services; Mumbai; On-site; INR 1,400,000 - 2,400,000; Full time

Job summary

ERGO Technology & Services in Mumbai seeks an experienced security specialist to conduct secure code reviews across web, mobile, and backend apps. You will triage vulnerabilities per OWASP Top 10, guide developers with remediation examples, and participate in threat modeling and secure SDLC practices.

You will review Java, JavaScript, Python, C/C++, SQL, ABAP, and Swift code, assess SAST findings with tools like Checkmarx/Fortify/SonarQube, and collaborate with delivery teams to close issues on

Qualifications

• Bachelor’s or Master’s degree in computer science/engineering/IT with relevant security exposure.
• 7–9 years of relevant experience for non-CS degrees or related security roles.
• Experience in secure code reviews for web/mobile/backend applications.
• Familiarity with OWASP Top 10 and common vulnerabilities and remediations.
• Experience reading code across Java, JavaScript, Python, C/C++, SQL, ABAP, Swift.

Responsibilities

• Perform secure code reviews for web, mobile, and backend apps.
• Identify vulnerabilities per OWASP Top 10, SANS, CWE.
• Review PRs and CI/CD pipelines for security issues.
• Validate and triage SAST findings and guide remediation.

Skills

Secure SDLC

DevSecOps

OWASP Top 10

SAST tools

Education

Bachelor/Master in CS/Engineering/IT

MBA in IT/Insurance/Finance

Tools

Checkmarx

Fortify

SonarQube

Job description

Role & responsibilities

• Within the central division Group Technology (GT) Vulnerability Management & Security Testing (IT1.6.4).
• Perform secure code reviews for web, mobile, and backend applications.
• Identify security vulnerabilities in line with OWASP Top 10, SANS, and CWE standards.
• Analyze and review code written in languages such as Java, JavaScript, Python, C/C++, SQL, ABAP, Swift, or similar.
• Review pull requests and CI/CD pipelines to detect and address security issues.
• Validate and triage SAST findings, including reducing false positives and prioritizing real issues.
• Provide clear, actionable remediation guidance to developers, including secure coding examples.
• Participate in threat modeling and identify design-level security risks.
• Collaborate with development, QA, and release teams throughout the development and release cycles.
• Contribute to the creation and maintenance of secure coding guidelines, standards, and best practices.
• Create and update documentation to support audits, compliance activities, and team training.
• Track identified vulnerabilities through their lifecycle to ensure timely remediation and closure.
• Prepare, document, and share test results and security assessment outcomes with stakeholders.

Key Accountabilities & Responsibilities:

• Manages the functions mailbox end to end, including triaging, prioritising, responding to queries, and escalating complex issues, ensuring clear and timely communication to stakeholders.
• Operates with a high degree of independence and ownership, acting as a trusted extension of leadership in day to day service delivery and stakeholder interactions.
• Functions as a proxy for the service lead for defined areas, representing the function with authority in meetings, communications, and decision making within established parameters.
• Independently drives service operations and coordinates cross functional activities, ensuring continuity of service and issue resolution during the service lead’s absence.
• Supports team success by contributing to continuous improvement.

Key Competencies & Skills required

Technical Skills:

• Knowledge of Secure SDLC (Secure Development Lifecycle) and DevSecOps practices.
• Experience performing secure code reviews and identifying common application security issues.
• Working knowledge of OWASP Top 10 (Web & API) and Common application vulnerabilities and their basic remediation approaches
• Hands-on experience with SAST tools such as Checkmarx, Fortify, and SonarQube.
• Familiarity with core security concepts, including authentication, authorization, cryptography, and session management.
• Ability to read, analyze, and understand existing codebases across multiple technologies.
• Proactive, self-directed, and able to manage assigned workloads while collaborating and cross-training with team members to ensure coverage.

Nice to have:

• Strong written and verbal communication skills, especially for explaining security risks and solutions to technical and non-technical stakeholders.
• Ability to work effectively in fast-paced, agile, and cross-functional team environments.
• Comfortable engaging with stakeholders at various levels, providing remediation guidance, and constructively challenging findings or decisions when necessary.
• Balanced judgment to consider multiple viewpoints while prioritizing security and organizational risk management.
• Patience and willingness to coach development teams on security concepts, helping to improve their secure coding practices over time.
• Proven experience in successfully managing business and partner relationships
• Calmness and clarity of thought under pressure with ability to maintain confidentiality and oversee and handle multiple requests at the same time
• A highly motivated person focusing on personal development, enablement with cultural awareness
• Excellent command of business English

Behavioral Skills:

• Good interpersonal, communication and organizational skills relevant to the role.
• Willingness to learn and quickly adapt to changing requirements.
• Proactive approach to identifying issues and presenting solutions and options
• Ability to direct and guide teams as relevant

Previous Experience & Qualifications

Minimum Educational Qualification:

• Bachelor’s or Master’s degree in Computer Science /Engineering/Information Technology
• Candidate with non-computer science degree must have minimum 7-9 year of relevant experience
• MBA in IT / Insurance/Finance can also apply for Requirements Engineer and Test Engineer role.

Certification if any:

• Certified in one or more relevant industry recognized certification such as CTPRA/CTPRP, CISM, CRISC, CISSP, CGEIT, ITCM, or other relevant industry certification.

Years Experience & Knowledge:

• 7-9 years in Secure Code Review and Application Securi