Security- Engineer

IBM; Bengaluru; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

IBM Bengaluru is seeking an experienced Security Professional to lead cybersecurity investigations, regulatory guidance, and risk management across the SDLC. You will design secure backend services in Python, conduct SAST/DAST scans, and drive remediation with development teams.

You will coordinate Penetration Testing, maintain threat models, and integrate security tooling into CI/CD pipelines, working with global engineers to strengthen the security posture of mission-critical systems.

Qualifications

• 7+ years hands-on Python development for scalable backend apps and REST APIs.
• Strong Python OO design, debugging, performance optimization, and automation.
• Hands-on with Application Security and Secure SDLC practices.
• Experience with SAST/DAST, Mend, PSIRT processes, and SRT.
• Experience coordinating or supporting internal/external Penetration Testing.
• Ability to analyze vulnerability reports and drive remediation with dev teams.
• Experience creating and reviewing product threat models.
• Knowledge of secure coding principles and common app security vulns.
• Experience integrating security tools into CI/CD and DevSecOps pipelines.
• Proficient with Git and CI/CD tools; familiar with Agile development.

Responsibilities

• Lead and manage cybersecurity investigations and incident response.
• Assess data privacy regulation impact and develop dashboards for ops.
• Provide regulatory guidance to account teams navigating requirements.
• Translate security projects into BAU tasks and ensure ongoing management.
• Monitor incident trends and drive security posture improvements.
• Design, develop, test, and maintain secure backend apps and automation tools in Python.
• Develop secure REST APIs following best practices.
• Perform SAST/DAST scans and triage Mend findings; drive remediation.
• Coordinate SRT and Penetration Testing activities with squads.
• Create and update product threat models as apps evolve.
• Conduct security design/architecture reviews; mitigate risks.
• Integrate security scanning into CI/CD pipelines for DevSecOps.
• Collaborate with architects, developers, and security teams across SDLC.

Skills

Python

REST APIs

Secure SDLC

SAST/DAST/PSIRT

Penetration Testing coordination

Vulnerability triage/remediation

Threat modeling

DevSecOps/CI-CD

Agile software development

Education

Master's Degree

Tools

Git

Jenkins/GitHub Actions

Docker

Kubernetes/OpenShift

SonarQube

Burp Suite

ZAP

Job description

Introduction

At IBM Infrastructure & Technology, we design and operate the systems that keep the world running. From high-resiliency mainframes and hybrid cloud platforms to networking, automation, and site reliability. Our teams ensure the performance, security, and scalability that clients and industries depend on every day. Working in Infrastructure & Technology means tackling complex challenges with curiosity and collaboration. You’ll work with diverse technologies and colleagues worldwide to deliver resilient, future-ready solutions that power innovation. With continuous learning, career growth, and a supportive culture, IBM provides the opportunities to build expertise and shape the infrastructure that drives progress.

Your Role And Responsibilities

As a seasoned Security Professional, you will play a critical role in ensuring the security, regulations, risk, and compliance of our organization. You will collaborate with various teams to operationalize security projects and provide guidance on regulations to account teams.

Your Primary Responsibilities Will Include

• Lead Cybersecurity Investigations: Participate in cybersecurity investigations, ensuring timely and effective responses to incidents, and review and approve root cause analysis and action plans.
• Deploy Data Privacy Regulations: Assess the impact of new data privacy regulations on our portfolio, deploy and track implementation, and develop dashboards for regulatory operational activities.
• Provide Regulatory Guidance: Offer help and guidance on regulations to account teams, enabling them to navigate complex regulatory requirements.
• Operationalize Security Projects: Work with other teams to translate security projects into business-as-usual tasks, ensuring seamless execution and ongoing management.
• Monitor Incident Trends: Track incident and action plan trends, identifying areas for improvement and optimizing our security posture.
• Design, develop, test, and maintain scalable backend applications and automation tools using Python.
• Develop secure REST APIs and backend services following secure coding best practices.
• Perform and analyze Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) scans.
• Review and triage Mend vulnerability findings and drive remediation through the PSIRT process.
• Coordinate and support Security Risk Testing (SRT) and Penetration Testing activities.
• Analyze security findings, identify false positives, prioritize genuine vulnerabilities, and work with development squads to drive remediation.
• Create, maintain, and continuously update product threat models as the application evolves.
• Conduct security design and architecture reviews to identify potential risks and recommend mitigation strategies.
• Integrate security scanning and automation into CI/CD pipelines to enable DevSecOps practices.
• Collaborate with architects, developers, and security teams to embed security throughout the SDLC.
• Act as the security champion for the product by promoting secure coding practices and improving the overall security posture.

Preferred Education

Master's Degree

Required Technical And Professional Expertise

• 7+ years of hands-on experience in Python application development, building scalable backend applications and REST APIs.
• Strong programming skills in Python with experience in object-oriented design, debugging, performance optimization, and automation.
• Hands-on experience with Application Security and Secure SDLC practices.
• Hands-on experience with SAST, DAST, Mend (Software Composition Analysis), PSIRT processes, and Security Risk Testing (SRT).
• Experience coordinating or supporting internal/external Penetration Testing activities.
• Strong experience analyzing vulnerability reports, triaging security findings, identifying false positives, and driving remediation with development teams.
• Hands-on experience creating, maintaining, and reviewing product threat models.
• Strong understanding of secure coding principles and common application security vulnerabilities.
• Experience integrating security tools into CI/CD pipelines and DevSecOps workflows.
• Experience with Git, CI/CD tools (Jenkins/GitHub Actions), and Agile software development practices.
• Excellent analytical, problem-solving, communication, and stakeholder management skills.

Preferred Technical And Professional Experience

• Experience with application security tools such as SonarQube, Burp Suite, ZAP, or equivalent.
• Experience performing architecture security reviews and security design assessments.
• Experience with cloud-native applications, Docker, Kubernetes/OpenShift, and API security.
• Familiarity with threat modeling tools would be advantage.
• Experience automating security validation and remediation using Python.
• Knowledge of Infrastructure as Code (Terraform/Ansible) security.
• Security certifications are an added advantage.
• Experience working in Agile/Scrum teams and collaborating across global engineering organizations.