Secure SDLC Engineer – Application Security & Code Review | NovoTree Minds Consulting | Bengaluru

NovoTree Minds Consulting; Bengaluru; On-site; INR 2,500,000 - 4,000,000; Full time

Job summary

NovoTree Minds Consulting Private Limited seeks a Secure SDLC Engineer in Bengaluru to own application security governance, code reviews, and vulnerability management across Java, Python, and web stacks. This on-site role requires 5+ years of hands-on experience and expertise in SAST/DAST tooling, OWASP Top 10 mitigation, and API security.

You will collaborate with DevSecOps and software squads through agile sprints, driving secure coding practices and security awareness.

Qualifications

• Bachelor9s or Master9s degree in Computer Science, Information Technology, Information Security, Cybersecurity, or related technical discipline.
• Minimum 5+ years of hands-on experience in application security, secure SDLC engineering, and vulnerability management.
• Strong operational expertise in secure code review and vulnerability assessment.
• Proficiency in OWASP Top 10, API security standards, and cryptographic protocols.
• Experience configuring SAST/DAST tools (SonarQube, Checkmarx, Fortify) and DAST tools (OWASP ZAP, Burp Suite).
• CI/CD security integration, DevSecOps workflows, and vulnerability tracking (Jira, DefectDojo).
• Excellent analytical, security auditing, and stakeholder communication skills.
• Eligible for legal work in Bengaluru; face-to-face interview required.

Responsibilities

• Lead Secure SDLC governance and secure coding standards across enterprise software.
• Conduct rigorous application security assessments, code reviews, and vulnerability remediation.
• Enforce OWASP Top 10 mitigation strategies and secure API security.
• Manage SAST/DAST tooling within CI/CD pipelines and vulnerability workflows.
• Collaborate with engineering and DevSecOps to promote secure coding practices.
• Participate in mandatory F2F technical interview rounds and security reviews.
• Maintain security assessment reports and compliance documentation.

Skills

Secure SDLC

Application security

Vulnerability management

Threat modeling

CI/CD integration

Security auditing

Stakeholder communication

Education

Bachelor9s degree in CS/IT

Tools

SonarQube

Checkmarx

Fortify

OWASP ZAP

Burp Suite

Jira

DefectDojo

GitHub Enterprise

Job description

Position Summary

Driving advanced application security, secure software development lifecycle (Secure SDLC) governance, and code review compliance in Bengaluru, NovoTree Minds Consulting Private Limited is actively seeking an accomplished Secure SDLC Engineer with 5+ years of experience for a permanent full-time professional engagement. In this vital technical leadership role, you will take full operational, tactical, and technical ownership of application security assessments, secure code reviews, OWASP Top 10 vulnerability remediation, and API security governance. Bringing extensive professional experience in cybersecurity, SAST/DAST pipeline integration, and vulnerability management, Monday to Friday operations with alternate Saturdays, and a mandatory face-to-face (F2F) interview format, you will empower an elite technology enterprise to achieve uncompromised software security posture, secure API endpoints, and superior vulnerability mitigation. This prestigious career opportunity offers competitive remuneration, professional development, and career growth within a leading global technical recruitment and IT consulting enterprise.

Detailed Job Description

As a Secure SDLC Engineer supporting NovoTree Minds Consulting Private Limited on an on-site professional basis in Bengaluru (operating Monday to Friday plus alternate Saturdays, with immediate joiners or candidates on up to 30 days notice preferred), you will take full operational, tactical, and technical ownership of application security governance, vulnerability scanning, secure coding standards enforcement, and cross-functional engineering collaboration. Your day-to-day responsibilities include conducting rigorous application security reviews and secure code audits across enterprise software systems, enforcing OWASP Top 10 mitigation strategies, securing RESTful and GraphQL APIs, managing Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tooling pipelines, driving vulnerability management and remediation workflows, participating in a mandatory face-to-face (F2F) interview process, collaborating proactively with software development squads and DevSecOps engineers during agile sprint cycles, and interacting directly with talent acquisition consultants like Akhilesh Bhandary. Furthermore, you will manage application requirements by submitting your updated resume via direct email to Akhilesh Bhandary at [e-mail].

Key Responsibilities

• Architect, implement, and govern comprehensive Secure Software Development Lifecycle (Secure SDLC) frameworks across enterprise software products.
• Conduct rigorous application security assessments, penetration testing, and manual/automated secure code reviews across Java, Python, and web stacks.
• Enforce OWASP Top 10 vulnerability remediation standards, secure authentication protocols, and robust input validation mechanisms.
• Secure enterprise RESTful and GraphQL APIs against injection attacks, broken authentication, and unauthorized data exposure.
• Integrate and manage Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tools within CI/CD pipelines.
• Drive comprehensive vulnerability management, severity triage, root-cause analysis, and developer remediation tracking.
• Collaborate proactively with software engineering squads to champion secure coding best practices and security awareness.
• Participate in mandatory face-to-face (F2F) technical interview rounds and security architecture review boards.
• Maintain meticulous security assessment reports, vulnerability matrices, compliance documentation, and secure coding runbooks.

Required Qualifications & Skills

• Bachelor’s or Master’s degree in Computer Science, Information Technology, Information Security, Cybersecurity, or related technical discipline.
• Minimum of 5+ years of progressive professional hands-on experience in application security, secure SDLC engineering, and vulnerability management.
• Strong, demonstrable operational expertise in secure code review, application vulnerability assessment, and threat modeling.
• Comprehensive working knowledge and practical proficiency in OWASP Top 10 mitigation, API security standards, and cryptographic protocols.
• Deep practical experience configuring and managing SAST (SonarQube, Checkmarx, Fortify) and DAST (OWASP ZAP, Burp Suite) testing tools.
• Solid practical grasp of CI/CD pipeline security integration, DevSecOps workflows, and vulnerability tracking platforms (Jira, DefectDojo).
• Exceptional analytical problem-solving aptitude, security auditing capabilities, and professional stakeholder communication skills.
• Mandatory legal work authorization and physical availability for professional operations in Bengaluru (with mandatory F2F interview attendance).

Nice-to-Have Skills

• Professional security certifications such as Certified Secure Software Lifecycle Professional (CSSLP), CISSP, CEH, or OSCP.
• Prior professional working experience supporting Tier-1 financial institutions, cybersecurity consultancies, or enterprise software product firms.
• Hands‑on familiarity with cloud security posture management (CSPM) across AWS, Azure, or GCP cloud environments.
• Experience utilizing enterprise agile tracking and collaboration platforms (Jira, Confluence, GitHub Enterprise).
• Active participation in application security user groups, OWASP chapters, or cybersecurity conferences.

Application Information

• Recruiter: NovoTree Minds Consulting Private Limited Recruitment Division
• Contact Name: Akhilesh Bhandary (Talent Acquisition Consultant)
• Email: [e-mail]
• Phone:
• Company Website: https://www.novotreeminds.com
• Salary/Rate: Market Competitive / Enterprise Application Security Package
• Work Schedule: Monday to Friday + Alternate Saturdays (Bengaluru)
• Deadline: Open until filled (Urgent Bengaluru Secure SDLC Engineer Opening)
• Notice Period: Immediate Joiners or Candidates with up to 30 Days Notice Preferred
• Contract Duration: Permanent / Full-Time Employment (Bengaluru)