Senior Cybersecurity Lead – DevSecOps and Governance

DNV; Chennai; Hybrid; INR 1,200,000 - 1,800,000; Full time

Job summary

DNV Group is seeking a Senior Cybersecurity Lead to own security processes across the SDLC for engineering teams in Chennai and the US. You will define and maintain security controls our teams follow across cloud platforms, embedding Secure SDLC/DevSecOps and leading penetration testing and vulnerability management.

You will partner with the AI team to secure AI-enabled features, drive security culture, audit readiness, and incident management, and report security risk to engineering and

Qualifications

• Proven experience leading cybersecurity initiatives across SDLC.
• Experience in cloud security across AWS/Azure.
• Strong understanding of penetration testing and vulnerability management.

Responsibilities

• Own security governance for the SDLC across internal and cloud apps.
• Define and maintain Secure SDLC / DevSecOps processes and controls.
• Partner with AI team to secure AI-enabled features and governance.
• Drive security culture, audit readiness, and incident management; report risk to leadership.

Skills

Security leadership

Secure SDLC

DevSecOps

Penetration testing

Vulnerability management

AI security

ISO 27001 SOC 2

Incident management

Job description

Senior Cybersecurity Lead to own security process and governance across the SDLC for engineering teams in Chennai and the US. Working with the Principal Security Engineer, you will define and maintain the security processes and controls our engineering teams follow across our cloud platforms. You will embed Secure SDLC/DevSecOps, run penetration testing and vulnerability management, partner with the AI team to secure and govern AI-enabled capabilities, and lead security culture, audit readiness, and incident management. You will also report security risk to engineering and business leaders.

What You’ll Do

You’ll own the process and governance for cybersecurity within the SDLC, focused on three core priorities:

• Embedding security into the SDLC. Partner with the Engineering team on design reviews, CI/CD testing, penetration testing, and vulnerability management.
• Securing and governing AI. Partner with the AI team to set the security and governance guardrails for AI/LLM-enabled features and AI-assisted development in Platform Services.
• Driving security culture and governance. Make security part of the definition of done for engineering and AI teams in Chennai and the US; lead ISO 27001 / SOC 2 audit readiness; work with the Principal Security Engineer on incident management.

Embed security into the SDLC

• Define and maintain Secure SDLC / DevSecOps processes, security controls, and review gates with engineering across internal and cloud-based apps.
• Integrate security testing and automation into CI/CD with Engineering and DevOps; define testing requirements and roll out secure-coding practices and tooling.
• Ensure architecture/design reviews and threat modelling happen early in delivery; work with the Principal Security Engineer to address identified risks.
• Institute cloud security review processes for AWS and/or Azure: ensure IAM, network, logging, encryption, and CI/CD security are reviewed with the relevant technical teams.
• Own the penetration testing process for web, API, cloud, and infrastructure: coordinate scoping, testing, reporting, remediation tracking, and retesting.
• Run the vulnerability management process with risk-based prioritization (exploitability, exposure, impact, asset criticality); coordinate remediation with engineering and track findings to closure.

Secure and govern AI

In partnership with the AI team:

• Set AI security policy and minimum controls for AI-enabled products and AI-assisted development (least privilege, tool allowlists, data-loss controls, input/output validation).
• Identify and track AI risks: data and code leakage, prompt injection, unsafe output, over-permissioned agents, model/supply-chain, and IP/licensing.
• Define oversight standards for AI agents: autonomy limits, when human approval is required, auditability, and AI incident escalation.
• Align with ISO/IEC 42001 and NIST AI RMF; provide evidence for audits and customer assurance.

Drive security culture and governance

• Run security awareness and secure-coding training for engineering teams in Chennai and the US.
• Mentor engineers on secure practices; coordinate with Engineering, AI, DevOps, Architecture, and Product on adoption.
• Support ISO 27001 / SOC 2 controls and audits; use security metrics and reporting to track adoption and improve processes.
• Partner with the Principal Security Engineer on security incident management: defining escalation paths, coordinating response, and leading post-incident reviews.