Senior Analyst

Marmon Holdings; Karnataka; On-site; INR 1,800,000 - 3,200,000; Full time

Job summary

Marmon Technologies India Private Limited, part of Marmon Holdings backed by Berkshire Hathaway, seeks a Senior Security Engineer to lead application security across the SDLC and own DAST and SAST operations. The role focuses on integrating security into GitHub, Azure and CI/CD workflows with strong collaboration across product, DevOps, and development teams.

Ideal candidates will have hands-on experience with SAST/DAST tools, vulnerability remediation and secure by design practices, while

Qualifications

• Strong hands-on SAST and DAST scanning experience required.
• Ownership of DAST operations, SAST engineering and penetration testing.
• Experience with DevSecOps and secure by design concepts.
• Ability to configure security gates and evidence for releases.

Responsibilities

• Embed security across design, development, testing and deployment lifecycles.
• Identify security gaps with development teams and provide remediation guidance.
• Define and maintain security gates, control requirements and evidence expectations.
• Own SAST and DAST setup, tuning and ongoing improvement.
• Plan web app, API and network penetration tests and document findings.
• Monitor scan performance, coverage and remediation trends.

Skills

SAST

DAST

Penetration testing

DevSecOps

GitHub

Azure

CI/CD

Security gates

Vulnerability remediation

Threat modeling

Tools

Invicti

Job description

Marmon Technologies India Private Limited

As a part of the global industrial organization Marmon Holdings-which is backed by Berkshire Hathaway- you'll be doing things that matter, leading at every level, and winning a better way. We're committed to making a positive impact on the world, providing you with diverse learning and working opportunities, and fostering a culture where everyone's empowered to be their best.

Under general direction, responsible for the maintenance of installed infrastructure technologies as well as the installation and configuration of these technologies within specific area. Develops design and functional specifications, produces deliverables related to specific projects and assists in post implementation support and system enhancements. May be involved with the configuration and maintenance of physical and logical network components. Additionally, this position may play an integral role in more complex system integration testing and evaluation within specific technology area of responsibility. Incumbent may mentor and oversee the work of other analysts. Role typically requires more than 5 years of experience.

Job Title: Senior Security Engineer

Shift Timings: General Shift Role

Summary

The Senior Security Engineer will lead application security engineering across the software development lifecycle. Strong hands-on SAST and DAST scanning experience is required, with primary ownership of DAST operations, SAST engineering, penetration testing, vulnerability remediation and DevSecOps enablement. The role will embed security into design and development, integrate security testing into Secure by Design (SBD), GitHub, Azure and CI/CD workflows, and work closely with development, QA, DevOps, cloud, and product teams to ensure security controls are implemented before production release.

Key Responsibilities

• Embed security requirements, threat considerations, secure coding practices, and control validation across design, development, testing, deployment, and maintenance phases.
• Work directly with development teams to identify security gaps early and provide practical remediation guidance while applications are being built.
• Define and maintain security gates, minimum control requirements, exception handling, and evidence expectations for application releases. SAST, DAST & Penetration Testing - Technical Responsibilities
• Own the implementation, configuration, administration, tuning and continuous improvement of enterprise SAST and DAST capabilities.
• Configure, operate and optimize Invicti for authenticated and unauthenticated DAST scans, including scan profiles, authentication, scheduling, coverage, validation, reporting, retesting and troubleshooting.
• Perform SAST scan onboarding and configuration, validate code-level findings, analyze data flows and sources/sinks, tune rules, suppress verified false positives with evidence and provide developer-ready remediation guidance.
• Plan and execute web application, API and network-focused penetration tests using approved methodologies and tools; document reproducible evidence, risk ratings, business impact and corrective actions.
• Triage and correlate SAST, DAST and penetration-testing findings; validate exploitability, remove duplicate or false-positive results, prioritize risk and confirm closure through rescans and retesting.
• Monitor technical scan performance, including scan completion, coverage, authentication success, scan failures, false-positive rates, recurring findings, test effectiveness and remediation trends.
• Integrate approved SAST and DAST controls into Secure by Design processes, GitHub repositories, pull requests, build workflows, CI/CD pipelines and release gates.
• Partner with DevOps and engineering teams to implement automated security scans, quality gates, severity thresholds, break-build criteria, and risk-based exception workflows.
• Administer and monitor security controls across GitHub and Azure development environments, including code scanning, secret scanning, dependency alerts, repository security settings, pipeline findings and cloud security configurations.
• Enforce branch protection, mandatory reviews, least-privilege access, environment separation, secure secrets handling and controlled promotion to production.
• Investigate scan and integration failures and retain security evidence for release governance and audit requirements.
• Manage the end-to-end application vulnerability lifecycle: identification, validation, prioritization, assignment, remediation tracking, retesting, closure and reporting.
• Drive SLA-based remediation with development owners, escalation overdue risks, support documented risk acceptance where justified and verify fixes through rescans or retesting.
• Maintain dashboards and metrics covering vulnerability aging, severity, closure performance, recurr