Senior Analyst

Marmon Technologies India Private Limited; Bengaluru; On-site; INR 1,200,000 - 2,100,000; Full time

Job summary

Marmon Technologies India Private Limited is seeking a Senior Security Engineer to lead application security across the SDLC. You will own SAST/DAST capabilities, embed security into design, and work with DevOps, QA, and product teams to ensure secure releases.

Role requires strong hands-on experience with Invicti, CI/CD integration, and secure coding practices. Collaboration with cloud and development teams is essential in a fast-paced environment.

Qualifications

• Bachelor’s degree in Computer Science or related field; 5–8 years of security experience.
• Hands-on experience implementing SAST/DAST in enterprise software development environments.
• Experience with Invicti or comparable DAST platforms and CI/CD integration.

Responsibilities

• Own the implementation, configuration, administration, tuning and continuous improvement of SAST and DAST capabilities.
• Configure, operate and optimize DAST scans, including authenticated/unauthenticated modes and reports.
• Plan and execute web app, API and network penetration tests; document evidence, risk, and remediation.
• Integrate security testing into GitHub and Azure CI/CD workflows; drive secure by design practices.

Skills

SAST

DAST

DevSecOps

Secure by Design

Threat modeling

Education

Bachelor’s degree in Computer Science or related field

Tools

Invicti

GitHub Actions

Azure DevOps

Job description

Marmon Technologies India Private Limited As a part of the global industrial organization Marmon Holdings—which is backed by Berkshire Hathaway—you’ll be doing things that matter, leading at every level, and winning a better way. We’re committed to making a positive impact on the world, providing you with diverse learning and working opportunities, and fostering a culture where everyone’s empowered to be their best. Under general direction, responsible for the maintenance of installed infrastructure technologies as well as the installation and configuration of these technologies within specific area. Develops design and functional specifications, produces deliverables related to specific projects and assists in post implementation support and system enhancements. May be involved with the configuration and maintenance of physical and logical network components. Additionally, this position may play an integral role in more complex system integration testing and evaluation within specific technology area of responsibility. Incumbent may mentor and oversee the work of other analysts. Role typically requires more than 5 years of experience. Job Title: Senior Security Engineer Shift Timings: General Shift Role Summary: The Senior Security Engineer will lead application security engineering across the software development lifecycle.

Strong hands‑on SAST and DAST scanning experience is required, with primary ownership of DAST operations, SAST engineering, penetration testing, vulnerability remediation and DevSecOps enablement. The role will embed security into design and development, integrate security testing into Secure by Design (SBD), GitHub, Azure and CI/CD workflows, and work closely with development, QA, DevOps, cloud, and product teams to ensure security controls are implemented before production release.

Key Responsibilities:

• Embed security requirements, threat considerations, secure coding practices, and control validation across design, development, testing, deployment, and maintenance phases.
• Work directly with development teams to identify security gaps early and provide practical remediation guidance while applications are being built.
• Define and maintain security gates, minimum control requirements, exception handling, and evidence expectations for application releases.
• Own the implementation, configuration, administration, tuning and continuous improvement of enterprise SAST and DAST capabilities.
• Configure, operate and optimize Invicti for authenticated and unauthenticated DAST scans, including scan profiles, authentication, scheduling, coverage, validation, reporting, retesting and troubleshooting.
• Perform SAST scan onboarding and configuration, validate code‑level findings, analyze data flows and sources/sinks, tune rules, suppress verified false positives with evidence and provide developer‑ready remediation guidance.
• Plan and execute web application, API and network‑focused penetration tests using approved methodologies and tools; document reproducible evidence, risk ratings, business impact and corrective actions.
• Triage and correlate SAST, DAST and penetration‑testing findings; validate exploitability, remove duplicate or false‑positive results, prioritize risk and confirm closure through rescans and retesting.
• Monitor technical scan performance, including scan completion, coverage, authentication success, scan failures, false‑positive rates, recurring findings, test effectiveness and remediation trends.

SAST, DAST & Penetration Testing - Technical Responsibilities

• Own the implementation, configuration, administration, tuning and continuous improvement of enterprise SAST and DAST capabilities.
• Configure, operate and optimize Invicti for authenticated and unauthenticated DAST scans, including scan profiles, authentication, scheduling, coverage, validation, reporting, retesting and troubleshooting.
• Perform SAST scan onboarding and configuration, validate code‑level findings, analyze data flows and sources/sinks, tune rules, suppress verified false positives with evidence and provide developer‑ready remediation guidance.
• Plan and execute web application, API and network‑focused penetration tests using approved methodologies and tools; document reproducible evidence, risk ratings, business impact and corrective actions.
• Triage and correlate SAST, DAST and penetration‑testing findings; validate exploitability, remove duplicate or false‑positive results, prioritize risk and confirm closure through rescans and retesting.
• Monitor technical scan performance, including scan completion, coverage, authentication success, scan failures, false‑positive rates, recurring findings, test effectiveness and remediation trends.

DevSecOps, CI/CD, Azure & GitHub Security

• Integrate approved SAST and DAST controls into Secure by Design processes, GitHub repositories, pull requests, build workflows, CI/CD pipelines and release gates.
• Partner with DevOps and engineering teams to implement automated security scans, quality gates, severity thresholds, break‑build criteria, and risk‑based exception workflows.
• Administer and monitor security controls across GitHub and Azure development environments, including code scanning, secret scanning, dependency alerts, repository security settings, pipeline findings and cloud security configurations.
• Enforce branch protection, mandatory reviews, least‑privilege access, environment separation, secure secrets handling and controlled promotion to production.
• Investigate scan and integration failures and retain security evidence for release governance and audit requirements.

Vulnerability Management & Remediation

• Manage the end‑to‑end application vulnerability lifecycle: identification, validation, prioritization, assignment, remediation tracking, retesting, closure and reporting.
• Drive SLA‑based remediation with development owners, elevate overdue risks, support documented risk acceptance where justified and verify fixes through rescans or retesting.
• Maintain dashboards and metrics covering vulnerability aging, severity, closure performance, recurrence, scan coverage and application risk posture.

Collaboration, Governance & Continuous Improvement

• Act as the application security partner for developers, architects, QA engineers, DevOps teams, product owners, cloud teams and infrastructure teams.
• Deliver secure coding guidance, developer awareness sessions, tool onboarding and knowledge‑sharing based on observed vulnerability patterns.
• Contribute to application security standards, procedures, checklists, playbooks, audit evidence and continuous improvement initiatives.
• Evaluate emerging AppSec and DevSecOps capabilities and recommend improvements that increase coverage, automation, accuracy and remediation speed.

Required Qualifications

• Bachelor’s degree in Computer Science, Information Security, Engineering or a related discipline or equivalent relevant experience.
• Minimum 5–8 years of hands‑on cyber security experience, with strong focus on application security, DevSecOps, vulnerability management or penetration testing.

Required: Strong hands‑on experience implementing, configuring, operating, tuning and troubleshooting both SAST and DAST solutions in enterprise software development environments.

Hands‑on experience with Invicti or a comparable enterprise DAST platform, including authenticated scanning, scan configuration, validation, tuning, reporting, troubleshooting and retesting.

• Hands‑on experience integrating security scanning into GitHub pull‑request workflows, Azure or equivalent cloud development environments, build systems, and CI/CD pipelines.
• Working knowledge of Azure security concepts, GitHub security capabilities, source control governance, secrets management, and secure deployment practices.
• Strong understanding of OWASP Top 10, secure SDLC, common web and API vulnerabilities, risk methodologies. rating, remediation techniques and penetration‑testing
• Ability to interpret code‑level findings and collaborate with developers on remediation across at least one common language or framework.
• Experience managing remediation SLAs, exceptions, evidence, dashboards, metrics, and stakeholder reporting.
• Clear written and verbal communication skills, including the ability to explain technical risks and corrective actions to both engineering and non‑technical stakeholders.

Preferred Skills and Certifications

• Experience with additional SAST, SCA, container, API or cloud‑native security tools.
• Exposure to tools and platforms such as GitHub Advanced Security, Azure DevOps, Jenkins, GitHub Actions or equivalent technologies.
• Familiarity with threat modeling, security architecture reviews, software supply‑chain security, SBOM practices, and compliance frameworks.
• Relevant certifications such as OSCP, OSWE, GWAPT, CSSLP, , CEH, Microsoft Azure Security Engineer Associate or equivalent AppSec / penetration‑testing credentials.

Following receipt of a conditional offer of employment, candidates will be required to complete additional job‑related screening processes as permitted or required by applicable law.

Welcome to the biggest small business you’ll ever find. Part of Berkshire Hathaway, Marmon is a global industrial organization made of 11 industry groups with 30K employees and $12 billion in annual revenue. As leaders in their respective industries, our 120+ companies thrive on an independent mindset and entrepreneurial spirit. At the same time, they benefit from being part of our industry groups—where they’re able to tap into the expertise and insights of other Marmon companies. While we’re all unique, we all share a common commitment to doing things that matter, leading at every level, and winning a better way. When you work at Marmon, you're advancing our everyday world and beyond. Our engineering solutions help millions around the world stay connected, healthy, and safe. Wherever you're at in your career, our people and resources will help you go further. As you grow your skills, you can also move up and around our 120+ companies. Work at a place you can stand behind. We show up to win every day, uphold the highest ethical standards, and always look to put each other in the best position to win.