Senior Security Engineer

Marmon Technologies India Pvt Ltd; Bengaluru Urban; Sur place; INR 1 500 000 - 2 300 000; Plein temps

Résumé du poste

Marmon Technologies India Pvt Ltd in Bengaluru is seeking a Senior Security Engineer to lead application security across the SDLC, owning hands-on SAST and DAST, and driving DevSecOps enablement.

You will embed security into design, enhance Secure by Design practices, and collaborate with development, QA, DevOps, cloud and product teams to ensure security controls are production-ready.

Qualifications

• Bachelor’s degree or equivalent in CS/InfoSec/Engineering.
• 5–8 years of hands-on cyber security with focus on AppSec, DevSecOps or pentesting.
• Proven experience implementing SAST and DAST in enterprise environments.
• Hands-on experience with Invicti or a comparable enterprise DAST platform, including authenticated scanning.
• Experience integrating security scanning into GitHub PR workflows and Azure/CI/CD pipelines.
• Knowledge of Azure, GitHub security concepts, and secure deployment practices.
• Strong understanding of OWASP Top 10 and secure SDLC.
• Ability to interpret code-level findings and work with developers on remediation.

Responsabilités

• Embed security requirements and secure coding practices across design, development, testing, deployment, and maintenance phases.
• Work directly with development teams to identify security gaps and provide remediation guidance during build.
• Define and maintain security gates, minimum control requirements, exception handling, and evidence expectations for releases.
• Own the implementation, configuration, administration, tuning and continuous improvement of SAST and DAST capabilities.
• Configure and optimize Invicti for authenticated/unauthenticated scans, including profiling, authentication, scheduling, reporting.
• Plan and execute web app, API and network-focused tests using verified methodologies; document risk and actions.
• Triage and correlate findings; validate exploitability; prioritize risk; confirm closure via retesting.
• Monitor scan performance and remediation trends; integrate controls into CI/CD and release gates.

Connaissances

Security engineering

DevSecOps

Vulnerability management

Penetration testing

OWASP Top 10

Secure by Design

Stakeholder communication

Formation

Bachelor’s degree in CS/InfoSec/Engineering or related field

Outils

Invicti

GitHub Advanced Security

Azure DevOps

Jenkins

GitHub Actions

Description du poste

Job Title: Senior Security Engineer Shift Timings: General Shift

Role Summary

The Senior Security Engineer will lead application security engineering across the software development lifecycle. Strong hands-on SAST and DAST scanning experience is required, with primary ownership of DAST operations, SAST engineering, penetration testing, vulnerability remediation and DevSecOps enablement. The role will embed security into design and development, integrate security testing into Secure by Design (SBD), GitHub, Azure and CI/CD workflows, and work closely with development, QA, DevOps, cloud, and product teams to ensure security controls are implemented before production release.

Key Responsibilities

Application Security & Secure by Design

• Embed security requirements, threat considerations, secure coding practices, and control validation across design, development, testing, deployment, and maintenance phases.
• Work directly with development teams to identify security gaps early and provide practical remediation guidance while applications are being built.
• Define and maintain security gates, minimum control requirements, exception handling, and evidence expectations for application releases.

SAST, DAST & Penetration Testing - Technical Responsibilities

• Own the implementation, configuration, administration, tuning and continuous improvement of enterprise SAST and DAST capabilities.
• Configure, operate and optimize Invicti for authenticated and unauthenticated DAST scans, including scan profiles, authentication, scheduling, coverage, validation, reporting, retesting and troubleshooting.
• Perform SAST scan onboarding and configuration, validate code-level findings, analyze data flows and sources/sinks, tune rules, suppress verified false positives with evidence and provide developer-ready remediation guidance.
• Plan and execute web application, API and network-focused penetration tests using approved methodologies and tools; document reproducible evidence, risk ratings, business impact and corrective actions.
• Triage and correlate SAST, DAST and penetration-testing findings; validate exploitability, remove duplicate or false-positive results, prioritize risk and confirm closure through rescans and retesting.
• Monitor technical scan performance, including scan completion, coverage, authentication success, scan failures, false-positive rates, recurring findings, test effectiveness and remediation trends.
• Integrate approved SAST and DAST controls into Secure by Design processes, GitHub repositories, pull requests, build workflows, CI/CD pipelines and release gates.
• Partner with DevOps and engineering teams to implement automated security scans, quality gates, severity thresholds, break-build criteria, and risk-based exception workflows.
• Administer and monitor security controls across GitHub and Azure development environments, including code scanning, secret scanning, dependency alerts, repository security settings, pipeline findings and cloud security configurations.
• Enforce branch protection, mandatory reviews, least-privilege access, environment separation, secure secrets handling and controlled promotion to production.
• Investigate scan and integration failures and retain security evidence for release governance and audit requirements.

Vulnerability Management & Remediation

• Manage the end-to-end application vulnerability lifecycle: identification, validation, prioritization, assignment, remediation tracking, retesting, closure and reporting.
• Drive SLA-based remediation with development owners, elevate overdue risks, support documented risk acceptance where justified and verify fixes through rescans or retesting.
• Maintain dashboards and metrics covering vulnerability aging, severity, closure performance, recurrence, scan coverage and application risk posture.

Collaboration, Governance & Continuous Improvement

• Act as the application security partner for developers, architects, QA engineers, DevOps teams, product owners, cloud teams and infrastructure teams.
• Deliver secure coding guidance, developer awareness sessions, tool onboarding and knowledge-sharing based on observed vulnerability patterns.
• Contribute to application security standards, procedures, checklists, playbooks, audit evidence and continuous improvement initiatives.
• Evaluate emerging AppSec and DevSecOps capabilities and recommend improvements that increase coverage, automation, accuracy and remediation speed.

Required Qualifications

• Bachelor’s degree in Computer Science, Information Security, Engineering or a related discipline or equivalent relevant experience.
• Minimum 5–8 years of hands‑on cyber security experience, with strong focus on application security, DevSecOps, vulnerability management or penetration testing.
• Required: Strong hands‑on experience implementing, configuring, operating, tuning and troubleshooting both SAST and DAST solutions in enterprise software development environments.
• Required: Hands‑on experience with Invicti or a comparable enterprise DAST platform, including authenticated scanning, scan configuration, validation, tuning, reporting, troubleshooting and retesting.
• Hands‑on experience integrating security scanning into GitHub pull‑request workflows, Azure or equivalent cloud development environments, build systems, and CI/CD pipelines.
• Working knowledge of Azure security concepts, GitHub security capabilities, sourcecontrol governance, secrets management, and secure deployment practices.
• Strong understanding of OWASP Top 10, secure SDLC, common web and API vulnerabilities, risk rating, remediation techniques and penetration‑testing methodologies.
• Ability to interpret code‑level findings and collaborate with developers on remediation across at least one common language or framework.
• Experience managing remediation SLAs, exceptions, evidence, dashboards, metrics, and stakeholder reporting.
• Clear written and verbal communication skills, including the ability to explain technical risks and corrective actions to both engineering and non‑technical stakeholders.

Preferred Skills and Certifications

• Experience with additional SAST, SCA, container, API or cloud‑native security tools.
• Exposure to tools and platforms such as GitHub Advanced Security, Azure DevOps, Jenkins, GitHub Actions or equivalent technologies.
• Familiarity with threat modeling, security architecture reviews, software supply‑chain security, SBOM practices, and compliance frameworks.
• Relevant certifications such as OSCP, OSWE, GWAPT, CSSLP, , CEH, Microsoft Azure Security Engineer Associate or equivalent AppSec / penetration‑testing credentials.