Senior Cybersecurity Lead – DevSecOps and Governance

Growth For Impact; Chennai; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Growth For Impact is seeking a cybersecurity leader to own governance within the SDLC for engineering teams in Chennai and the US. You will embed security into design reviews, CI/CD testing, penetration testing, and vulnerability management while defining Secure SDLC / DevSecOps processes and gates.

You will drive cloud security review processes, AI security guardrails, and risk-based remediation, enabling secure and auditable development across on-prem and cloud environments.

Qualifications

• Experience securing SDLC for engineering teams.

Responsibilities

• Own the cybersecurity governance within the SDLC for engineering teams in Chennai and the US.
• Embed security into the SDLC with design reviews, CI/CD testing, penetration testing, and vulnerability management.
• Define and maintain Secure SDLC / DevSecOps processes, security controls, and review gates.
• Integrate security testing and automation into CI/CD pipelines with secure-coding practices.

Skills

Cybersecurity

Secure SDLC

DevSecOps

Threat modelling

Penetration testing

Tools

CI/CD tooling

Job description

ROLE

• Own the process and governance for cybersecurity within the SDLC for engineering teams in Chennai and the US.
• Embed security into the SDLC by partnering with engineering on design reviews, CI/CD testing, penetration testing, and vulnerability management.
• Define and maintain Secure SDLC / DevSecOps processes, security controls, and review gates for internal and cloud‑based applications.
• Integrate security testing and automation into CI/CD pipelines; define testing requirements and roll out secure‑coding practices and tooling.
• Ensure architecture/design reviews and threat modelling occur early in delivery and address identified risks.
• Institute cloud security review processes for AWS and/or Azure, covering IAM, network, logging, encryption, and CI/CD security.
• Own the penetration testing process for web, API, cloud, and infrastructure, including scoping, testing, reporting, remediation tracking, and retesting.
• Run the vulnerability management process with risk‑based prioritization and coordinate remediation with engineering to track findings to closure.
• Partner with the AI team to set security and governance guardrails for AI/LLM‑enabled features and AI‑assisted development.
• Establish AI security policy and minimum controls, including least privilege, tool allowlists, data‑loss controls, and input/output validation.
• Identify, track, and mitigate AI risks such as data and code leakage, prompt injection, unsafe output, over‑permissioned agents, model supply‑chain issues, and IP/licensing concerns.
• Define oversight standards for AI agents, including autonomy limits, human approval requirements, auditability, and AI incident escalation.
• Align AI security practices with ISO/IEC 42001 and NIST AI RMF and provide evidence for audits and customer assurance.
• Run security awareness and secure‑coding training for engineering teams in Chennai and the US.
• Mentor engineers on secure practices and coordinate adoption with Engineering, AI, DevOps, Architecture, and Product teams.
• Support ISO 27001 / SOC 2 controls and audits; use security metrics and reporting to track adoption and improve processes.
• Partner with the Principal Security Engineer on security incident management, defining escalation paths, coordinating response, and leading post‑incident reviews.
• Report security risk to engineering and business leaders.