TC - CS - CTM - Appsec - Senior

EY; Bengaluru; On-site; INR 1,500,000 - 2,500,000; Full time

Benefits offered by this job

Health and wellness packages

Rewards and learning opportunities

Job summary

EY's Global Delivery Services in Bengaluru seeks a Senior Consultant for DevSecOps and Application Security to embed SSDLC across the software life cycle. You will implement Secure SDLC, integrate security tools into CI/CD, perform security assessments, and partner with DevOps, architects, and developers to harden pipelines and cloud deployments.

The role emphasizes hands-on testing (SAST/DAST/SCA), automation scripting, and threat modeling, with exposure to AWS/Azure/GCP, Docker/Kubernetes, and

Qualifications

• BE/B.Tech/MCA degree required.
• Minimum 3 years of work experience in relevant roles.
• Certifications: AWS SCS-C01 or equivalent preferred.

Responsibilities

• Implement SSDLC across application development and CI/CD pipelines.
• Perform security assessments including SAST, DAST, and SCA.
• Integrate and automate security tools within CI/CD pipelines.
• Support secure coding practices and remediation in development teams.
• Lead DevSecOps pipeline implementation and optimization.
• Assist in threat modeling and secure design reviews.
• Develop automation scripts for security testing and reporting.
• Collaborate with DevOps and cloud teams to implement security controls in cloud environments.

Skills

Application security testing

CI/CD pipelines

DevSecOps

Threat modeling

OWASP Top 10

Cloud platforms (AWS/Azure/GCP)

Scripting (Python/PowerShell/Java)

Education

BE/B.Tech/MCA

Tools

Jenkins

Azure DevOps

GitHub/GitLab

Burp Suite

WebInspect

AppScan

Checkmarx

Fortify

Veracode

Coverity

Aqua

Invicti

GHAS

Git Guardian

Docker

Kubernetes

Job description

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.

Position Title: EYGDS_Cyber Security DevSecOps Senior

About Global Delivery Services

Global Delivery Services refers to EY's worldwide network of service delivery centers. The GDS team plays an important role in EY’s strategy by ensuring effective support to EY’s growth agenda.

Our journey started in 2002 with approximately 200 people. Today we stand at 80,000+ professionals in ten locations around the world. We operate in Argentina, China, Hungary, India, Philippines, Poland, Sri Lanka, Mexico, Spain and the United Kingdom.

Client service is focused on providing Consulting, Assurance, Tax, Strategy & Transactions, and Knowledge support to our clients around the world. The teams enable account teams worldwide to provide seamless, high-quality, value-added support, helping deliver exceptional client service.

Enablement Services provides cost-effective, high-skilled, and innovative services to support EY’s global and local enablement teams. Markets, BMC, AWS, Finance and Accounting, Risk Management, Procurement, People Shared Services, IT Service Delivery and IT Global Infrastructure services, are among the services offered by Enablement Services.

Our innovation specialists serve the GDS Client Service and Enablement Services teams, along with Service Lines, Core Business Services and Sectors. The team brings the desired environment, technologies and skilled teams together for facilitation, rapid prototyping and innovative thinking. The competencies offered include analytics, digital, user experience, mobile technology, infrastructure, Microsoft technologies and open innovation.

Overview

As part of our Cyber Security team, you will implement and support Secure SDLC (SSDLC) and DevSecOps practices across the software development lifecycle, ensuring security is embedded into design, development, testing, and deployment stages.

You will perform hands‑on security assessments of applications, APIs, and supporting infrastructure, and work closely with DevOps, Architects, Developers, and QA teams to integrate security into CI/CD pipelines. You will analyze security findings, provide remediation guidance, and contribute to building secure, scalable application delivery practices.

The Opportunity

We’re looking for a Senior Consultant – DevSecOps / Application Security with strong hands‑on expertise in secure SDLC and pipeline security. This role offers the opportunity to work on end‑to‑end DevSecOps implementations, supporting clients and engineering teams in embedding security across CI/CD pipelines.

You will collaborate with cross‑functional teams to implement Security as Code (SaC), automation, and cloud‑native security controls, while contributing to the adoption of AI‑assisted security capabilities and modern application security practices.

Your Key Responsibilities

• Implement Secure SDLC (SSDLC) practices across application development and CI/CD pipelines.
• Perform application security assessments including SAST, DAST, SCA, and basic threat modeling.
• Integrate and automate security tools within CI/CD pipelines (e.g., secret scanning, IaC scanning, container security).
• Support development teams in secure coding practices, vulnerability remediation, and code reviews.
• Work on DevSecOps pipeline implementation and optimization using enterprise and open‑source tools.
• Assist in threat modeling exercises (e.g., STRIDE) and secure design reviews.
• Develop scripts and automation for security testing, reporting, and tool integration.
• Collaborate with DevOps and cloud teams to implement security controls in cloud environments (AWS/Azure/GCP).
• Analyze security findings and create detailed reports with risks, exploitation scenarios, and remediation steps.
• Support adoption of container security, IaC security, and compliance‑as‑code practices.
• Contribute to AI‑assisted security use cases, such as automated triaging, code analysis, and developer productivity tools.
• Stay current with emerging security threats, vulnerabilities, and DevSecOps trends.

Skills and Attributes for Success

• Strong hands‑on experience in application security testing (SAST, DAST, SCA).
• Experience working with CI/CD pipelines and DevOps tools (Jenkins, Azure DevOps, GitHub/GitLab).
• Proficiency in scripting/programming (Python, PowerShell, Java, etc.).
• Familiarity with DAST tools (Burp Suite, WebInspect, AppScan), SAST,SCA tools (Checkmarx, Fortify, Veracode, Coverity), Container security tools (Aqua, Invicti etc.), Secret scanning tools (GHAS Git Guardian etc.).
• Understanding of OWASP Top 10 and secure coding practices.
• Experience with cloud platforms (AWS/Azure/GCP) and basic cloud security concepts.
• Exposure to container technologies and security tools (Docker, Kubernetes).
• Understanding of DevSecOps practices and SSDLC frameworks (OWASP SAMM, NIST SSDF).
• Hands‑on experience with SCM tools (GitHub, GitLab, Bitbucket) and pipeline integrations.
• Good understanding of threat modeling concepts (e.g., STRIDE).
• Exposure to AI/ML or GenAI tools in development/security workflows (e.g., AI‑assisted code analysis, automation).
• Strong problem‑solving skills and ability to work in cross‑functional teams.

To qualify for the role, you must have

• BE/ B.Tech/ MCA.
• Minimum 3 years of work experience
• Certifications: Mandatory to have any one of the below certifications,
• AWS security speciality certification (SCS-C01)
• Knowledge of Windows, Linux, UNIX, any other major operating systems.
• Strong Excel and PowerPoint skills.

Ideally, you’ll also have

• Certifications: CSSLP, Certified DevSecOps Professional

What we look for

• A candidate who can build a complete CI/CD pipeline from scratch, prepare, and work around a maturity model and optimize the pipeline to integrate the best tools according to the client requirement.

What we offer you

At EY, we’ll develop you with future‑focused skills and equip you with world‑class experiences. We’ll empower you in a flexible environment, and fuel you and your extraordinary talents in a diverse and inclusive culture of globally connected teams.

• Our Commitment: As a commitment, we persistently endeavour to embody our values, fulfil our purpose, and champion inclusiveness. Our dedication is to cultivate EY into an environment where diverse perspectives are celebrated, creating a supportive atmosphere for individuals to authentically be themselves and contribute their utmost.
• Professional Development: From entry‑level employees to senior leaders, we believe in continuous learning. We offer opportunities to build new skills, take on leadership roles, and connect and grow through mentorship.
• People and Culture: In our dynamic workplace, diversity, equity, and inclusiveness are ingrained in our culture. We're united by a commitment to create an environment where every individual's differences are valued, practices are equitable, fostering a sense of belonging. Our shared values include integrity, respect, teaming, inclusiveness, energy, enthusiasm, courage to lead, and building relationships based on doing the right thing.
• Benefits: Embark on a transformative career journey with us and indulge in a suite of premium benefits, encompassing exclusive health and wellness packages, enticing rewards, and cutting‑edge learning opportunities that empower you to continually grow and excel in your professional and personal development.

EY | Building a better working world

EY exists to build a better working world, helping to create long‑term value for clients, people and society and build trust in the capital markets.

Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.

Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.

Select how often (in days) to receive an alert:

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.