Manager - AppSec/DevSecOps Security Engineer

EXL Talent Acquisition Team; Dadri; Presencial; INR 1 400 000 - 2 100 000; Tempo integral

Resumo da oferta

EXL Talent Acquisition Team seeks an experienced AppSec leader to own security strategy, drive testing across web, mobile, and source-code reviews, and mentor a team of security engineers. You will oversee DevSecOps integration and governance, collaborating with engineering and product leadership.

The role emphasizes risk management, client discussions, audits, and compliance with standards such as OWASP, NIST, ISO 27001, PCI-DSS, and SOC 2.

Qualificações

• Own and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements.
• Lead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development.
• Act as the primary escalation point for application security risk decisions across engineering and product leadership.
• Drive continuous improvement in AppSec tooling, methodologies, and coverage metrics.
• Represent the AppSec function in client discussions, audits, risk committees, and vendor assessments.

Responsabilidades

• Oversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios.
• Define and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements.
• Review and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders.
• Drive responsible disclosure and coordinated vulnerability management for critical findings.
• Lead mobile security assessments for Android and iOS—static/dynamic analysis, reverse engineering, and runtime manipulation.
• Establish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams.
• Guide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security.
• Conduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others).
• Define code review standards and integrate SAST tooling into development workflows.
• Provide actionable, developer-centric findings with clear severity ratings and remediation guidance.
• Track remediation SLAs and report on code security posture trends over time.
• Lead integration of security tooling into CI/CD pipelines (Jenkins, GitHub Actions, and similar).
• Define pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left.
• Oversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls.
• Collaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection.
• Own the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership.
• Ensure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2.
• Define and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates.
• Translate regulatory and client security requirements into testable engineering controls.
• Assess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows.

Conhecimentos

Leadership

Program Management

AppSec

Team Mentoring

Client Interaction

Threat Modeling

Ferramentas

SAST

DAST

SCA

Semgrep

Checkmarx

Veracode

SonarQube

Jenkins

GitHub Actions

Terraform

CloudFormation

Descrição da oferta de emprego

Leadership & Programme Management

• Own and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements.
• Lead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development.
• Act as the primary escalation point for application security risk decisions across engineering and product leadership.
• Drive continuous improvement in AppSec tooling, methodologies, and coverage metrics.
• Represent the AppSec function in client discussions, audits, risk committees, and vendor assessments.

Web Application Penetration Testing

• Oversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios.
• Define and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements.
• Review and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders.
• Drive responsible disclosure and coordinated vulnerability management for critical findings.

Mobile Application Security

• Lead mobile security assessments for Android and iOS—static/dynamic analysis, reverse engineering, and runtime manipulation (Frida, objection, Drozer).
• Establish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams.
• Guide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security.

Source Code Review

• Conduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others).
• Define code review standards and integrate SAST tooling (Semgrep, Checkmarx, Veracode, SonarQube) into development workflows.
• Provide actionable, developer-centric findings with clear severity ratings and remediation guidance.
• Track remediation SLAs and report on code security posture trends over time.

DevSecOps Integration

• Lead integration of security tooling (SAST, DAST, SCA, container scanning, API security) into CI/CD pipelines (Jenkins, GitHub Actions, and similar).
• Define pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left.
• Oversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls.
• Collaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection.

Governance, Risk & Compliance

• Own the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership.
• Ensure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2.
• Define and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates.
• Translate regulatory and client security requirements into testable engineering controls.

AI / GenAI Security

• Assess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows (OWASP LLM Top 10, prompt injection, data leakage).

Incorporate AI security testing into standard AppSec assessment methodologies.