Senior Manager – Secure Software Development Lifecycle (SSDLC)

Enphase Energy

Bengaluru

Hybrid

INR 3,000,000 - 6,000,000

Full time

9 days ago

Get more replies from employers

Send a job-specific resume in minutes.

Benefits offered by this job

Competitive compensation and benefits

Leadership opportunities

Exposure to cutting-edge cybersecurity

Collaborative and innovative work

Job summary

Enphase Energy is seeking a Cloud Security Test Manager to guard our global cloud platforms. Lead offensive security programs across SAST, DAST, penetration testing, and threat modeling for Enlighten, Enphase App, and device APIs.

You will manage a team of testers, work with the CISO's office to drive vulnerability lifecycle, and align with MITRE ATT&CK and industry standards. This hybrid onsite role requires 3 days in office in Bengaluru, India.

Qualifications

10+ years of experience in application/cloud security testing.
5+ years leading security or red-team functions.
Strong experience with SAST, DAST, and SCA tooling; CI/CD integration, rule tuning, and triage.

Responsibilities

Build and lead the application and cloud security testing roadmap and team.
Integrate SAST, DAST, SCA, and secrets scanning into CI/CD pipelines; tune rules, triage results, and manage false positives.
Conduct and oversee manual penetration testing of web apps, REST/GraphQL APIs, microservices, and cloud platforms against OWASP Top 10 and API Top 10.
Plan and run red-team and purple-team exercises mapped to MITRE ATT&CK.
Lead threat modeling (STRIDE/PASTA) for new services and architecture reviews.
Own end-to-end vulnerability lifecycle management — risk-based prioritization, remediation tracking, SLAs.
Collaborate closely with the CISO’s office to report risks, KPIs, and remediation SLAs.
Define and enforce security standards across cloud environments.
Perform container, Kubernetes, and cloud-native security testing across multi-cloud (AWS/GCP/Azure) environments.
Develop custom exploits, payloads, and automation to validate exploitability and reduce false positives.

Skills

Security leadership

Offensive security

Threat modeling

Cloud security

Penetration testing

CI/CD security

Scripting (Python/Bash)

Communication

Stakeholder management

Education

BE/BTech/MS/MTech in CS/EE

Tools

SAST

DAST

SCA tooling

CI/CD tooling

Kubernetes security tooling

Cloud security tooling (AWS/GCP/Azure)

Threat modeling tools (STRIDE/PASTA)

MITRE ATT&CK

Job description

Description

Enphase Energy is a global energy technology company and a leading provider of solar, battery, and electric vehicle charging products. Founded in 2006, our innovative microinverter technology revolutionized solar power, making it a safer, more reliable, and scalable energy source. Today, the Enphase Energy System enables users to make, use, save, and sell their own power. Enphase is also one of the most successful and innovative clean energy companies in the world, with more than 80 million products shipped across 160 countries. Join our dynamic teams designing and developing next‑gen energy technologies and help drive a sustainable future! This role at Enphase requires working onsite 3 days a week, with plans to transition back to a full 5 day in office schedule over time.

About the role

As the Cloud Security Test Manager, you will lead the offensive security function protecting Enphase’s cloud platform, including Enlighten, Enphase App, and device APIs that connect over 4M homes globally. In this role, you will build and lead the security testing program across SAST, DAST, penetration testing, threat modeling, and red‑team operations. You will manage a team of testers while staying hands‑on to guide exploitation strategies and validate findings, partnering closely with the CISO’s office to manage the vulnerability lifecycle end to end.

What you will be doing

Build and lead the application and cloud security testing roadmap and team
Integrate SAST, DAST, SCA, and secrets scanning into CI/CD pipelines (Jenkins, GitLab, GitHub Actions); tune rules, triage results, and manage false positives to drive shift‑left adoption
Conduct and oversee manual penetration testing of web apps, REST/GraphQL APIs, microservices, and cloud platforms against OWASP Top 10 and API Top 10
Plan and run red‑team and purple‑team exercises mapped to MITRE ATT&CK — initial access, exploitation, post‑exploitation, lateral movement, and detection validation with the SOC
Lead threat modeling (STRIDE/PASTA) for new services and architecture reviews, defining attack surfaces, trust boundaries, and security requirements
Own end‑to‑end vulnerability lifecycle management — risk‑based prioritization, remediation tracking, SLAs, and metrics — from identification through verified closure
Collaborate closely with the CISO’s office to report risks, KPIs, and remediation SLAs
Define and enforce security standards and best practices across cloud environments
Perform container, Kubernetes, and cloud‑native security testing across multi‑cloud (AWS/GCP/Azure) environments
Develop custom exploits, payloads, and automation to validate exploitability and reduce false positives

What you bring

BE/BTech/MS/MTech in Computer Science, Electrical Engineering, or a related field.
A minimum of 10+ years of experience in application/cloud security testing, with
5+ years leading security or red‑team functions
Strong experience with SAST, DAST, and SCA tooling, CI/CD integration, rule tuning, and triage at scale
Hands‑on manual penetration testing of web apps, APIs, microservices, and cloud environments, with exploit/PoC development
Expertise in threat modeling frameworks (STRIDE, PASTA) and attack surface analysis
Strong experience in red‑team operations, adversary emulation (MITRE ATT&CK), C2 frameworks, and purple‑team collaboration
Deep understanding of cloud security across AWS/GCP/Azure — IAM and identity, network controls, container/Kubernetes (RBAC, escapes), serverless, and secrets management
Knowledge of OWASP Top 10 / API Top 10 and CVE disclosure processes
Familiarity with security standards such as IEC 62443, EU Cyber Resilience Act, SOC 2, ISO 27001
Excellent leadership, communication, and stakeholder management skills
Proficiency in scripting (Python, Bash) for security automation and custom tooling