Senior Lead Engineer - Security Consultant

Esyasoft; Kolkata District; On-site; INR 2,500,000 - 4,500,000; Full time

Job summary

Esyasoft is seeking a Security Consultant to assess, design, implement, and maintain information security controls across complex environments. The role ensures compliance with standards, manages cyber risks, and supports secure digital transformation initiatives.

The candidate will architect secure solutions, embed security into DevSecOps, and lead security testing, governance, and incident response efforts in enterprise contexts. Strong collaboration with stakeholder teams is essential.

Qualifications

• Strong knowledge of cyber security principles, tools, and frameworks.
• Hands-on experience with vulnerability assessment and penetration testing tools.
• Experience in application, infrastructure, and cloud security.
• Knowledge of security compliance and regulatory standards.
• Understanding of networking, operating systems, and databases.
• Strong documentation, reporting, and stakeholder communication skills.

Responsibilities

• Assess security posture across applications, infrastructure, and networks.
• Design secure architectures and guardrails aligned with standards.
• Lead secure coding practices and review source code for vulnerabilities.
• Support cloud security controls and DevSecOps integration.
• Assist in incident response, investigations, and root cause analysis.
• Coordinate with teams for audits, policy development, and governance.
• Provide security guidance to stakeholders and conduct awareness sessions.
• Prepare security assessment reports, dashboards, and risk summaries.

Skills

Cyber security principles

Vulnerability assessment

Penetration testing

Cloud security

Regulatory compliance

Networking understanding

Operating systems knowledge

Documentation & reporting

Stakeholder communication

Education

Bachelor's degree in Computer Science/IT/Cyber Security

Certifications: CISSP/CISM/CEH/ISO27001 Lead Implementer/Auditor/AWS-Azure-GCP

Tools

SAST

DAST

SCA

CI/CD security tooling

SIEM deployments

Job description

Job Summary

The Security Consultant is responsible for assessing, designing, implementing, and maintaining information security controls to protect organizational systems, networks, and data. The role ensures compliance with security standards, manages cyber risks, and supports secure digital transformation initiatives.

Responsibilities

• Security Assessment & Risk Management: Architect enterprise-wide Application Security (AppSec) programs across complex, distributed enterprise environments - embedding SAST, DAST, and SCA into CI/CD pipelines to enable secure-by-design architecture and reduce vulnerabilities. Define secure architecture patterns and guardrails, integrating AppSec controls into DevSecOps pipelines to standardize risk management across distributed engineering teams. Collaborated with Customer Security teams to embed security architecture principles to produce secure project environment. Experience in Application Security governance frameworks, aligning with NIST, ISO 27001, and PCI DSS to achieve compliance posture and audit readiness. Conduct security risk assessments, vulnerability assessments, and threat modeling across applications, infrastructure, and networks. Identify security gaps and provide risk-based mitigation recommendations. Perform periodic security posture reviews and maturity assessments.
• Security Architecture & Solution Design: Design and review secure architecture for applications, cloud, and on-premise systems. Ensure security-by-design principles are embedded in system development and integration. Review technical designs to ensure alignment with security standards and best practices.
• Application & Infrastructure Security: Support and define application security testing (SAST, DAST, API security testing). Support secure coding practices and review source code for vulnerabilities. Assess infrastructure security including servers, databases, networks, and endpoints.
• Cloud & DevSecOps Security: Implement and review cloud security controls for AWS, Azure, or GCP environments. Integrate security tools into CI/CD pipelines (DevSecOps). Lead full-lifecycle SIEM deployments, from HLD/LLD design through to steady-state operations. Produce detailed solution proposals, policies, and procedures to support secure, reliable SIEM services. Ensure secure configuration, identity access management, and logging in cloud platforms.
• Security Operations & Incident Management: Support security incident detection, response, and investigation activities. Perform root cause analysis and recommend corrective and preventive actions. Coordinate with SOC, IT, and business teams during security incidents.
• Compliance & Governance: Ensure compliance with security frameworks and regulations (ISO 27001, NIST, GDPR, etc.). Support internal and external security audits and risk assessments. Develop and maintain security policies, standards, and procedures.
• Awareness & Stakeholder Engagement: Provide security guidance to development, infrastructure, and business teams. Conduct security awareness sessions and training programs. Act as a trusted advisor on security best practices and emerging threats.
• Continuous Improvement & Reporting: Stay updated with latest cyber security threats, vulnerabilities, and trends. Prepare security assessment reports, dashboards, and risk summaries for management. Recommend continuous improvements to enhance organizational security posture.

Requirements

• Qualification: Bachelor's degree in Computer Science, Information Technology, Cyber Security, or related field.
• Professional Certificate Preferred: CISSP (Certified Information Systems Security Professional). CISM (Certified Information Security Manager). CEH (Certified Ethical Hacker). ISO/IEC 27001 Lead Implementer or Lead Auditor. AWS / Azure / GCP Security Certification. CompTIA Security+ (added advantage).
• Years of Exp: 8-13 years of experience in information security, cyber security consulting, or related roles
• Job Specific Skill: Strong knowledge of cyber security principles, tools, and frameworks. Hands-on experience with vulnerability assessment and penetration testing tools. Experience in application, infrastructure, and cloud security. Knowledge of security compliance and regulatory standards. Understanding of networking, operating systems, and databases. Strong documentation, reporting, and stakeholder communication skills.