SAST/DAST Engineer

Capgemini; Maharashtra; On-site; INR 1,400,000 - 2,100,000; Full time

Benefits offered by this job

Learning platform access for 250,000++

Belonging culture at Capgemini

Cutting-edge tech projects

Green campuses in India

Job summary

Capgemini India seeks a senior Application Security Lead to drive security testing across multiple applications and projects. You will mentor engineers, coordinate with cross-functional teams, and help embed Secure SDLC and DevSecOps practices, including SAST/DAST, SCA, and threat modelling.

You will lead security engagements, triage findings, and provide remediation guidance while maintaining strong stakeholder relations and client communications.

Qualifications

• 5–9 years of experience in Application Security, Vulnerability Management, or Product Security.
• Strong hands-on expertise in Static Application Security Testing (SAST).
• Strong hands-on expertise in Dynamic Application Security Testing (DAST).
• Experience with Software Composition Analysis (SCA) tools and methodologies.
• Knowledge of Grey Box Security Testing techniques and Threat Modelling.
• Experience with Secure SDLC practices and OWASP Top 10 risks.
• Familiarity with OWASP ASVS and API Security Testing.

Responsibilities

• Lead and manage application security testing activities across multiple applications and projects.
• Oversee engagements involving SAST, DAST, SCA, Grey Box Testing, and Threat Modelling.
• Review findings, triage vulnerabilities, and provide remediation guidance to development teams.
• Coordinate with application, development, infrastructure, and security stakeholders.
• Drive governance reviews, status reporting, risk tracking, and client communications.
• Mentor security testing engineers and promote DevSecOps practices.

Skills

SAST

DAST

Grey Box Testing

Threat Modelling

Vulnerability Assessments

CI/CD Security

Stakeholder Management

Client-facing Communication

Education

Security certifications (CEH, CSSLP, GWAPT, OSCP, CISSP)

Tools

SCA tools

SAST tools

DAST tools

CI/CD tooling

Job description

• Lead and manage application security testing activities across multiple applications and projects.
• Oversee and drive engagements involving SAST, DAST, SCA, Grey Box Security Testing, and Threat Modelling.
• Review security findings, perform vulnerability triaging, and provide remediation recommendations to development teams.
• Coordinate closely with application, development, infrastructure, and security stakeholders.
• Drive governance reviews, status reporting, risk tracking, and client communications.
• Ensure compliance with Secure SDLC practices and application security best practices.
• Support integration of security tools and controls within CI/CD pipelines and DevSecOps initiatives.
• Mentor, coach, and provide technical guidance to security testing engineers and team members.
• Promote continuous improvement of application security processes, standards, and methodologies.

Your Role:

• Lead and manage application security testing activities across multiple applications and projects.
• Oversee and drive engagements involving SAST, DAST, SCA, Grey Box Security Testing, and Threat Modelling.
• Review security findings, perform vulnerability triaging, and provide remediation recommendations to development teams.
• Coordinate closely with application, development, infrastructure, and security stakeholders.
• Drive governance reviews, status reporting, risk tracking, and client communications.
• Ensure compliance with Secure SDLC practices and application security best practices.
• Support integration of security tools and controls within CI/CD pipelines and DevSecOps initiatives.
• Mentor, coach, and provide technical guidance to security testing engineers and team members.
• Promote continuous improvement of application security processes, standards, and methodologies.

Your Profile:

• 5 to 9 years of experience in Application Security, Vulnerability Management, or Product Security.
• Strong hands-on expertise in Static Application Security Testing (SAST).
• Strong hands-on expertise in Dynamic Application Security Testing (DAST).
• Experience with Software Composition Analysis (SCA) tools and methodologies.
• Good understanding of Grey Box Security Testing techniques.
• Expertise in Threat Modelling and risk identification.
• Experience conducting Vulnerability Assessments and security reviews.
• Strong knowledge of Secure Software Development Lifecycle (Secure SDLC) practices.
• In-depth understanding of OWASP Top 10 security risks and mitigation techniques.
• Familiarity with OWASP ASVS (Application Security Verification Standard).
• Experience with API Security Testing and securing modern web services.
• Ability to analyze security findings and provide effective remediation guidance to development teams.
• Experience supporting security tool integration within CI/CD pipelines and DevSecOps environments.
• Strong stakeholder management, communication, reporting, and client-facing skills.
• Prior experience leading application security engagements and mentoring junior security engineers.
• Relevant security certifications such as CEH, CSSLP, GWAPT, OSCP, CISSP, or equivalent are desirable.

What will you love working at Capgemini:

• You will have the opportunity to learn on one of the industry's largest digital learning platforms, with access to 250,000+ courses and numerous certifications.
• We're committed to ensure that people of all backgrounds feel encouraged and have a sense of belonging at Capgemini. You are valued for who you are, and you can bring your original self to work.
• At Capgemini, you can work on cutting-edge projects in tech and engineering with industry leaders or create solutions to overcome societal and environmental challenges.
• Capgemini office campuses in India are green and run on 100% renewable electricity. We have installed Solar plants across India locations and 'Battery Energy Storage Solution' (BESS) in the Noida and Mumbai campuses. You will have chance to make a difference everyday.