Lead - Application Security SSDLC

Reporting Structure

Reports to Senior Manager – SSDLC

Education

University degree in the field of computer science or IT.

Experience/ Qualifications

·     6+ years of Information Security background is essential.

·     4+ years of Software Development Lifecycle, Security reviews in project lifecycle

·     Experience in evaluating the control environment through Architecture, Software Design reviews and or not limited to Threat Modelling.

·     Security reviews of design flaws

·     Hands on experience in Static Application Security Testing and Dynamic Application Security Testing.

·     Experience in standardizing application security tools and methodology

·     Should be familiar with the best practices of OWASP, SANS Institute, ISACA, GAO, FISCAM, NSA, NIST, Internet Engineering Task Force (IETF)

·     Develop a detailed security framework to be followed by developers in every steps of software development lifecycle.

·     Experience in software/application analysis tools like SAST, DAST, SCA, IAST, RASP, threat modelling, etc.

Industry

Information technology

Responsibilities

·     Conduct internal / third-party Security (SSDLC) Risk Assessments on business-critical assets and processes.

·     Coordinate with project teams for ensuring security framework to enforced in all phases of SSDLC

·     Prepare security effectiveness reports for management.

·     Testing the applications / systems for SSDLC framework to RBI / ReBIT Information Security practices

·     Ensure new applications are inducted into Data centre after conducting SSDLC assessments

·     Follow up on closure of these gaps and escalate when necessary

·     Define and enhance application security requirements and standards which must be designed for agile development methods leveraging traditional application architectures

·     Assist DevSecOPs team to create secure predictable CI/CD pipeline processes, and enable application teams to develop new capabilities securely

Certifications (any two)

• CISSP

• CSSLP

• Certificates related to cloud security

• Certificates related to DevSecOps automation