Senior Associate, Cyber/IT Security, Technology and Operations

DBS Bank Ltd; India; On-site; INR 3,000,000 - 5,200,000; Full time

Job summary

I-Think Techno in Mumbai (Kanjurmarg) seeks a Senior Associate to manage IT security across applications, cloud and infra. You will lead vulnerability management, conduct security testing, and embed security in CI/CD with DevSecOps governance.

The role requires 8–12+ years of hands-on experience, strong stakeholder management, and knowledge of OWASP/NIST/ISO 27001. Strong cloud and security tooling exposure is essential.

Qualifications

• Extensive hands-on IT security background with leadership in security design.
• Experience in secure SDLC, OWASP, NIST, PCI DSS guidelines.
• Strong ability to translate security issues to business risk.
• Experience with security tools for SAST/DAST/SCA and CI/CD.

Responsibilities

• Lead application security assessments and remediation guidance.
• Own vulnerability management lifecycle across apps, cloud, and infra.
• Integrate security controls into CI/CD pipelines and DevSecOps.
• Coordinate red team activities and validate findings with stakeholders.
• Monitor compliance and support audits with evidence

Skills

Application Security

Vulnerability Management

DevSecOps

Red Teaming

Cloud Security

Security Governance

Stakeholder Management

Education

BE IT/Computers/Electronics

BSc Computers

MSc Computers

PGDIT

MCA

MBA

Tools

Rapid7

Nessus

Metasploit

QualysGuard

Burp Suite

OWASP ZAP

Checkmarx

Fortify

Veracode

Snyk

WhiteSource (Mend)

Postman

Job description

## Senior Associate, Cyber/IT Security, Technology and OperationsApply: Infrastructure, Cloud & Information Security: I-Think Techno, Kanjurmarg: Full time: Posted Today: End Date: October 31, 2026 (21 days left to apply): WD89492**Business Function**Technology and Operations (T&O) enables and empowers the bank with an efficient, nimble and resilient infrastructure through a strategic focus on productivity, quality & control, technology, people capability and innovation. In Group T&O, we manage the majority of the Bank's operational processes and inspire to delight our business partners through our multiple banking delivery channels.**Job Purpose**The purpose of this job role is to manage IT Security with strong hands-on capabilities across Application Security, Vulnerability Management, DevSecOps, and Red Teaming. The role requires end-to-end ownership from security design and troubleshooting to project execution, compliance monitoring, and continuous improvement of the security posture.**Key Accountabilities**1. Vulnerability management and Penetration Testing2. Application security3. Virtualization and container technologies (Docker, Kubernetes, OpenShift).4. API Security, Red Teaming & Security Testing5. CI/CD assessment6. IS Related compliance and regulatory reporting**Job Duties & Responsibilities****Application Security**1. Lead application security assessments including SAST, DAST, IAST, SCA, and manual code reviews.2. Identify, validate, and prioritize application security vulnerabilities and guide remediation with development teams.3. Ensure secure design and implementation aligned with OWASP Top 10, ASVS, and secure coding standards.4. Review application architecture and data flows from a security perspective.**Vulnerability Management**1. Own the end-to-end vulnerability management lifecycle across applications, infrastructure, cloud, and endpoints.2. Perform vulnerability validation, risk-based prioritization, exception handling, and closure tracking.3. Coordinate with multiple stakeholders to ensure timely remediation and SLA adherence.4. Provide management-level reporting on vulnerability trends, risk exposure, and remediation status.**DevSecOps**1. Integrate security controls into CI/CD pipelines (e.g., code scanning, dependency scanning, secrets management).2. Enable shift-left security by embedding security checkpoints in development and deployment processes.3. Work closely with DevOps teams to automate security testing and compliance checks.4. Define and enforce secure SDLC and DevSecOps governance.**Red Teaming & Security Testing**1. Coordinate and manage red team / penetration testing exercises (internal and external).2. Validate findings, assess business impact, and track remediation to closure.3. Support purple team activities to improve detection and response capabilities.4. Conduct root cause analysis and provide improvement recommendations.**Compliance & Governance Monitoring**1. Monitor and ensure compliance with internal security policies, standards, and regulatory requirements.2. Support audits, assessments, and regulatory reviews by providing evidence and technical clarifications.3. Track security issues, risk acceptances, and remediation plans across all security domains.**Troubleshooting & Project Ownership**1. Act as a senior escalation point for complex security issues and incidents.2. Lead security initiatives and projects from planning and execution to closure.3. Coordinate with cross-functional teams to resolve security gaps without impacting business timelines.**Requirements**1. 8–12+ years of experience in IT / Information Security, with strong hands-on exposure.2. Deep understanding of Application Security, Vulnerability Management, DevSecOps, and Red Teaming.3. Strong knowledge of web, API, cloud, and infrastructure security.4. Experience working with security tools (SAST/DAST/SCA, vulnerability scanners, CI/CD tools).5. Solid understanding of security frameworks and standards (OWASP, NIST, ISO 27001, PCI DSS – preferred).6. Ability to translate technical security issues into business and risk impact.7. Strong stakeholder management and communication skills.**Education / Preferred Qualifications**1. Graduation: BE IT/Computers/Electronics, B.Sc - Computers, M.Sc - Computers2. Post-Graduation: PGDIT, MCA, MBA3. Certification like CISSP, CISM, SANS, OSCP/OSCE and CREST (Prefered)**Core Competencies**1. Excellent analytical and decision-making skill sets2. Effective in Communication, documentation and report writing skills3. Ability to consult and validate solutions to mitigates risks to business and systems**Technical Competencies**1. VAPT - Rapid7, Nessus, Metasploit, QualysGuard, Burpsuite ,CI/CD tool etc.2. Technical working knowledge (WAF, HIDS, IPS, Firewall, Networking3. SAST: Checkmarx, Fortify, Veracode, SonarQube , DAST: Burp Suite, OWASP ZAP, AppScan4. SCA: Black Duck, Snyk, WhiteSource (Mend)5. API Security: Postman, Burp, OWASP API tools.