Senior Cyber Security Engineer

Reserve Bank Information Technology; Navi Mumbai; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Reserve Bank Information Technology (ReBIT) in Navi Mumbai seeks a security specialist to drive secure SDLC practices across projects. You will perform security reviews, SAST/DAST/SCA activities, and contribute to threat modelling and secure architecture.

Responsibilities include reporting vulnerabilities, supporting SSDLC tool integration, working with developers and product owners in an Agile environment, and communicating risks clearly to stakeholders in English.

Qualifications

• Experience with secure SDLC for Waterfall/Agile methodologies.
• Familiarity with security best practices (OWASP, NIST).
• Ability to review security of microservices and APIs.
• Hands-on experience with code reviews using SAST tools.
• Hands-on experience with DAST and SCA.

Responsibilities

• Perform security best practices reviews with the Development team.
• Perform SCA and report vulnerabilities and recommendations.
• Perform Tech Stack review and report findings with recommendations.
• Perform code reviews using SAST tools and report valid issues to development team.
• Perform DAST on applications and report valid issues to development team.
• Contribute to RFP processes and assist in implementing SSDLC tools.
• Escalate issues and risks and take ownership for resolution.
• Track milestones and provide status updates to stakeholders.

Skills

Secure SDLC

OWASP/NIST

API Security

SAST

DAST

SCA

Tech Stack Review

Agile

Cloud/VMware

Threat Modelling

Education

Bachelor's in CS/IT

Tools

SAST Tool

DAST Tool

SCA Tool

Job description

Role & responsibilities

• Perform security best practices review followed by Development team
• Perform SCA and report vulnerabilities and recommendations
• Perform Tech Stack review and report findings along with recommendations.
• Perform code review (supporting SAST Tool) and remove false positives if any, and report valid security issues to development team
• Perform DAST on the various applications and remove false positives if any, and report valid security issues to development team
• Contribution to RFP process and assist in Implementing SSDLC Tools.
• Escalate issues and risks and proactively takes ownership for resolution
• Track milestones and deliverables and provide regular status reporting to respective stakeholders

Preferred candidate profile

• Experience in the following process areas:
• Secure SDLC Methodologies for Waterfall/ Agile software development (Mandatory)
• Should be well-versed with Security best practices like OWASP and NIST guidelines (Mandatory)
• Ability to perform security review of microservices architecture, API Security (Mandatory)
• Hands on experience on Source Code reviews - SAST solution (Mandatory)
• Hands on experience on Dynamic Application Security Testing - DAST (Mandatory)
• Hands on experience in Software Composition Analysis - SCA (Mandatory)
• Hands on experience in performing Tech Stack Review -(Mandatory)
• Comfortable working in an environment that practices Agile development, engaging Product Owner and other stakeholders
• Good knowledge of Cloud platform/VMware
• Ability to identify vulnerabilities & threat actors in the application cycle and communicate effectively to the stake holders.
• Threat Modelling PASTA, STRIDE etc (Good to Have)
• Possesses ability to quickly understand the technical and functional aspects of the project to be able to communicate effectively with different stakeholders.
• Excellent written and verbal communication skills in English, high integrity, strong work ethic and ability to empathize with the customer.
• Ability to work effectively in a fast-paced, project-oriented environment
• Ability to prioritize and execute tasks
• Ability to handle sensitive and confidential information
• Strong analytical and problem-solving skills