Manager Application Security SSDLC

Responsibilities:

• Plan and lead Application Security Assessments.
• Manage, mentor, and assign tasks to SSDLC Engineers.
• Drive Secure Coding practices, automation, continuous assessment, and vulnerability remediation across design, development, and deployment.
• Manage integration of SAST, DAST, and SCA tools into CI/CD pipelines.
• Establish standards for manual and automated security code reviews.
• Prioritize and track vulnerabilities from discovery through engineering remediation.
• Enforce Security Quality Gates before production deployment.
• Define and track AppSec metrics, including time-to-remediate and defect density.
• Prepare weekly/monthly service delivery reports and review them with BU Head and VH.
• Guide Secure Coding best practices and conduct Application Security training.
• Review Security Standards, SOPs, and Secure Coding practices.
• Conduct Project Delivery Reviews with Software Development Project Managers.
• Ensure periodic open-source dependency checks and code reviews during development and production.
• Participate in internal and external audits.
• Participate in Security Risk Assessments and Audits.
• Review the effectiveness of Application Security Controls and prepare Risk Dashboards.
• Collaborate with internal and external stakeholders for timely project/engagement delivery.
• Review project status and take approved corrective and preventive measures.
• Provide service delivery inputs to PMO and relevant systems.
• Provide SME guidance on security tool capabilities and configuration adjustments to contain incidents or prevent future attacks.
• Participate in continual improvement and benchmarking activities.
• Contribute to CoE initiatives and other activities assigned by the BU Head or Vertical Head.

Requirements:

• Excellent written and verbal communication skills in English.
• High integrity, strong work ethic, and ability to empathize with customers.
• 7+ years of experience in Application Security, with 2+ years of experience leading technical teams.
• Experience in a large organization, bank, global IT, or consulting firm is desired.
• Strong background in Application Security and Secure Software Development Lifecycle (SSDLC).
• Strong background in Secure Coding using Java, . NET, PHP, Python, C#, etc., and CI/CD tools.
• Strong experience in Application Security Testing: SCA, SAST, and DAST.
• Expert knowledge of Agile and DevSecOps maturity models.
• Exposure to Application Security tools integration in DevOps architecture.
• Exposure to Microservices Security, API Security, and AI Security.
• Exposure to evaluation and implementation of Application Security and Testing tools.
• Strong troubleshooting and problem-solving skills, including analytical thinking and attention to detail.
• Good understanding of Application Security Standards such as OWASP, SANS, NIST, and MITRE.
• Good understanding of Security by Design and Privacy by Design principles.
• Exposure to Cloud Application / SaaS Security Solutions is desirable.
• Good understanding of Encryption, SSL, Key Management, HSM, PKI Infrastructure, and Secrets Management.