Application Security SME

Tata Consultancy Services; Taguig; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

Tata Consultancy Services is looking for an experienced Application Security professional in the Philippines to conduct VA/PT, threat modeling, and secure design reviews for web apps, APIs, cloud-native, and AI-enabled solutions.

You will execute DAST, remediation verification, and retesting, while integrating security controls into CI/CD pipelines. You will collaborate with cross-functional teams and stay current with threats and best practices in the field.

Qualifications

• Bachelor’s degree in CS/IT/Cybersecurity or related field.
• Minimum five years in Application Security, Penetration Testing, or related roles.
• Hands-on with Web App and API security assessments.
• Strong knowledge of Threat Modeling and secure design reviews.
• Familiarity with OWASP Top 10 and secure coding practices.

Responsibilities

• Conduct VA/PT using industry methodologies and tools.
• Perform threat modeling and secure design reviews for apps, APIs, cloud-native, and AI-enabled solutions.
• Execute DAST and remediation verification, including retesting.
• Support DevSecOps by integrating security controls into CI/CD pipelines.
• Assess architectures, cloud services, integrations, and emerging tech.
• Develop risk-based remediation recommendations and improvement plans.
• Prepare assessment reports, risk assessments, and executive summaries.
• Present findings to stakeholders and technical teams.
• Collaborate with development, architecture, and infrastructure teams to strengthen security posture.
• Provide SME in application security, secure coding, AI security, and vulnerability management.
• Maintain and improve security policies, standards, and testing methodologies across SDLC/DevSecOps.
• Stay current with threats and industry best practices.

Skills

App security

Penetration testing

Threat modeling

Secure SDLC

DevSecOps

Security reporting

Education

Bachelor's in CS/IT/Cybersecurity

Cybersecurity-related field

Tools

Burp Suite

Qualys

Nessus

Nmap

Metasploit

Kali Linux

Job description

• Conduct Vulnerability Assessments and Penetration Testing (VA/PT) using industry-standard methodologies and tools.
• Perform Threat Modeling and Secure Design Reviews for applications, APIs, cloud-native, and AI-enabled solutions.
• Execute DAST, vulnerability validation, remediation verification, and retesting activities.
• Support DevSecOps initiatives by integrating security controls into CI/CD pipelines.
• Assess application architectures, cloud services, third-party integrations, and emerging technologies.
• Develop risk-based remediation recommendations and security improvement plans.
• Prepare assessment reports, risk assessments, and executive summaries.
• Present findings and recommendations to stakeholders and technical teams.
• Collaborate with development, architecture, infrastructure, and business teams to strengthen the organization's security posture.
• Provide subject matter expertise in application security, secure coding, AI security, and vulnerability management.
• Develop, maintain, and continuously improve Application Security policies, standards, procedures, and testing methodologies to enhance security governance, standardization, and secure development practices across the SDLC and DevSecOps lifecycle.
• Stay current with emerging threats, security trends, and industry best practices.

Qualifications

• Bachelor's Degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
• Minimum of five (5) years of experience in Application Security, Penetration Testing, Vulnerability Assessment, Security Architecture, or related cybersecurity roles.
• Hands-on experience in Web Application and API Security Assessments.
• Strong knowledge of Threat Modeling, Secure Design Reviews, Security Architecture, Secure SDLC, and DevSecOps.
• Solid understanding of OWASP Top 10, OWASP API Security Top 10, and secure coding practices.
• Experience performing manual penetration testing, vulnerability validation, and remediation verification.
• Familiarity with AI/LLM security concepts and assessment methodologies.
• Strong communication, reporting, and stakeholder management skills.

Preferred Skills

• Proficiency in security testing tools including Burp Suite, Qualys, Nessus, Nmap, Metasploit, Kali Linux and similar application security and vulnerability assessment platforms.
• Vulnerability Management and Security Compliance
• Scripting and automation using PowerShell, Python, or Bash
• AI/LLM Security Assessments and Threat Modeling
• Mobile Application Penetration Testing (iOS and Android)
• SAST, DAST, SCA, and Secure Code Review methodologies
• DevSecOps, CI/CD Security, and Security Automation
• Cloud, Container, Kubernetes, and Microservices Security
• Security Architecture Reviews, Red Teaming, or Adversary Simulation Exercises
• Professional certifications such as OSCP, GPEN, GWAPT, CISSP or equivalent Application Security and Penetration Testing certifications are an advantage