Senior Associate, Cyber/IT Security, Technology and Operations
DBS Bank Ltd
Get a reply from this employer
Your resume and cover letter, tailored to exactly what they’re hiring for.
Job summary
DBS Bank Ltd in India is seeking a senior IT security professional to oversee security across applications, vulnerability management, and DevSecOps, including red team activities.
You will own security design, troubleshooting, project execution, and compliance monitoring, coordinating with cross-functional teams to improve the bank's security posture.
The role requires 8–12+ years of experience, strong knowledge of OWASP/ISO standards, and hands-on expertise with industry tools.
Qualifications
- 8–12+ years of experience in IT / Information Security with hands-on exposure.
- Deep understanding of Application Security, Vulnerability Management, DevSecOps, and Red Teaming.
- Strong knowledge of web, API, cloud, and infrastructure security.
- Experience with security tools (SAST/DAST/SCA, vulnerability scanners, CI/CD tools).
- Solid understanding of security frameworks and standards (OWASP, NIST, ISO 27001, PCI DSS – preferred).
- Ability to translate technical security issues into business risk.
- Strong stakeholder management and communication skills.
Responsibilities
- Lead application security assessments including SAST, DAST, IAST, SCA, and manual code reviews.
- Identify, validate, and prioritize security vulnerabilities and guide remediation with development teams.
- Ensure secure design and implementation aligned with OWASP Top 10, ASVS, and secure coding standards.
- Own end-to-end vulnerability management across apps, infra, cloud, and endpoints.
- Coordinate with stakeholders to ensure timely remediation and SLA adherence.
- Integrate security controls into CI/CD pipelines and shift-left security.
- Coordinate red team exercises and track remediation to closure.
- Monitor compliance with internal policies and regulatory requirements.
Skills
Education
Tools
Job description
Technology and Operations (T&O) enables and empowers the bank with an efficient, nimble and resilient infrastructure through a strategic focus on productivity, quality & control, technology, people capability and innovation. In Group T&O, we manage the majority of the Bank's operational processes and inspire to delight our business partners through our multiple banking delivery channels.
Technology and Operations (T&O) enables and empowers the bank with an efficient, nimble and resilient infrastructure through a strategic focus on productivity, quality & control, technology, people capability and innovation. In Group T&O, we manage the majority of the Bank's operational processes and inspire to delight our business partners through our multiple banking delivery channels.
The purpose of this job role is to manage IT Security with strong hands‑on capabilities across Application Security, Vulnerability Management, DevSecOps, and Red Teaming. The role requires end‑to‑end ownership from security design and troubleshooting to project execution, compliance monitoring, and continuous improvement of the security posture.
- Vulnerability management and Penetration Testing
- Application security
- Virtualization and container technologies (Docker, Kubernetes, OpenShift).
- API Security, Red Teaming & Security Testing
- CI/CD assessment
- IS Related compliance and regulatory reporting
- Lead application security assessments including SAST, DAST, IAST, SCA, and manual code reviews.
- Identify, validate, and prioritize application security vulnerabilities and guide remediation with development teams.
- Ensure secure design and implementation aligned with OWASP Top 10, ASVS, and secure coding standards.
- Review application architecture and data flows from a security perspective.
- Own the end‑to‑end vulnerability management lifecycle across applications, infrastructure, cloud, and endpoints.
- Perform vulnerability validation, risk‑based prioritization, exception handling, and closure tracking.
- Coordinate with multiple stakeholders to ensure timely remediation and SLA adherence.
- Provide management‑level reporting on vulnerability trends, risk exposure, and remediation status.
- Integrate security controls into CI/CD pipelines (e.g., code scanning, dependency scanning, secrets management).
- Enable shift‑left security by embedding security checkpoints in development and deployment processes.
- Work closely with DevOps teams to automate security testing and compliance checks.
- Define and enforce secure SDLC and DevSecOps governance.
- Coordinate and manage red team / penetration testing exercises (internal and external).
- Validate findings, assess business impact, and track remediation to closure.
- Support purple team activities to improve detection and response capabilities.
- Conduct root cause analysis and provide improvement recommendations.
- Monitor and ensure compliance with internal security policies, standards, and regulatory requirements.
- Support audits, assessments, and regulatory reviews by providing evidence and technical clarifications.
- Track security issues, risk acceptances, and remediation plans across all security domains.
- Act as a senior escalation point for complex security issues and incidents.
- Lead security initiatives and projects from planning and execution to closure.
- Coordinate with cross‑functional teams to resolve security gaps without impacting business timelines.
- 8–12+ years of experience in IT / Information Security, with strong hands‑on exposure.
- Deep understanding of Application Security, Vulnerability Management, DevSecOps, and Red Teaming.
- Strong knowledge of web, API, cloud, and infrastructure security.
- Experience working with security tools (SAST/DAST/SCA, vulnerability scanners, CI/CD tools).
- Solid understanding of security frameworks and standards (OWASP, NIST, ISO 27001, PCI DSS – preferred).
- Ability to translate technical security issues into business and risk impact.
- Strong stakeholder management and communication skills.
- Graduation: BE IT/Computers/Electronics, B.Sc - Computers, M.Sc - Computers
- Post‑Graduation: PGDIT, MCA, MBA
- Certification like CISSP, CISM, SANS, OSCP/OSCE and CREST (Prefered)
- Excellent analytical and decision‑making skill sets
- Effective in Communication, documentation and report writing skills
- Ability to consult and validate solutions to mitigates risks to business and systems
- VAPT - Rapid7, Nessus, Metasploit, QualysGuard, Burpsuite ,CI/CD tool etc.
- Technical working knowledge (WAF, HIDS, IPS, Firewall, Networking
- SAST: Checkmarx, Fortify, Veracode, SonarQube , DAST: Burp Suite, OWASP ZAP, AppScan
- SCA: Black Duck, Snyk, WhiteSource (Mend)
- API Security: Postman, Burp, OWASP API tools.
I-Think Techno, Kanjurmarg
Technology
Regular
Full time
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
