Lead SSDLC

Honeybee Tech Solutions; Navi Mumbai; On-site; INR 900,000 - 1,300,000; Full time

Job summary

Honeybee Tech Solutions is seeking a security-focused professional with 6+ years in information security and 4+ years in SSDLC to lead security reviews across project lifecycles. You will assess architecture, threat models, and implement robust security practices throughout development.

Responsibilities include conducting risk assessments, enforcing RBI/ReBIT-aligned security standards, and guiding DevSecOps to build secure CI/CD pipelines, ensuring secure deliveries across applications.

Qualifications

• 6+ years of Information Security background.
• 4+ years of SDLC security reviews in project lifecycle.
• Experience in threat modelling and architecture/design reviews.
• Hands-on security testing: SAST/DAST/IAST/SSoC security tools.

Responsibilities

• Conduct internal/third-party SSDLC risk assessments on business-critical assets and processes.
• Coordinate with project teams to enforce the security framework in all SSDLC phases.
• Prepare security effectiveness reports for management and testing the applications/systems for RBI/ReBIT information security practices.
• Define and enhance security requirements and standards for agile development.
• Assist DevSecOps to create secure CI/CD pipelines and enable secure development of new capabilities.

Skills

Information Security

Software Development Lifecycle (SSDLC)

Threat Modelling

SAST

DAST

SCA

IAST

RASP

OWASP

NIST

Tools

CI/CD security

Threat modelling tools

Job description

Role & responsibilities

Experience/ Qualifications 6+ years of Information Security background is essential. 4+ years of Software Development Lifecycle, Security reviews in project lifecycle Experience in evaluating the control environment through Architecture, Software Design reviews and or not limited to Threat Modelling.

Security reviews of design flaws Hands on experience in Static Application Security Testing and Dynamic Application Security Testing. Experience in standardizing application security tools and methodology Should be familiar with the best practices of OWASP, SANS Institute, ISACA, GAO, FISCAM, NSA, NIST, Internet Engineering Task Force (IETF) Develop a detailed security framework to be followed by developers in every steps of software development lifecycle.

Experience in software/application analysis tools like SAST, DAST, SCA, IAST, RASP, threat modelling, etc.

Industry

Information technology

Responsibilities

Conduct internal / third-party Security (SSDLC) Risk Assessments on business-critical assets and processes. Coordinate with project teams for ensuring security framework to enforced in all phases of SSDLC Prepare security effectiveness reports for management. Testing the applications / systems for SSDLC framework to RBI / ReBIT Information Security practices Ensure new applications are inducted into Data centre after conducting SSDLC assessments Follow up on closure of these gaps and **escalate** when necessary Define and enhance application security requirements and standards which must be designed for agile development methods leveraging traditional application architectures Assist DevSecOPs team to create secure predictable CI/CD pipeline processes, and enable application teams to develop new capabilities securely

Certifications (any two)

CISSP CSSLP Certificates related to cloud security

Certificates related to DevSecOps automation