Security testing

Exp- 7 to 8 Yrs Location -Mumbai(Mahape) 4 Days work from office , 1 Day work from home Key Responsibilities Pipeline Security Integration: Design, implement, and manage security tools and processes within the CI/CD pipeline. Vulnerability Management: Oversee and lead VAPT (Vulnerability Assessment and Penetration Testing) efforts for all applications. Tool Expertise: Administer and operate a suite of security tools, including: SAST (Static Application Security Testing): Checkmarx, SonarQube.

Snyx SCA (Software Composition Analysis): Snyk. DAST (Dynamic Application Security Testing): Acunetix, Burp Suite, AppScan. Threat Modeling: Conduct threat modeling exercises to identify potential security risks early in the development lifecycle.

Security Automation : Automate security testing and vulnerability scanning processes to improve efficiency and reduce manual intervention. Collaboration : Work closely with development, operations, and QA teams to remediate vulnerabilities and promote a security-first culture. Reporting : Generate and present detailed reports on security posture, vulnerability trends, and remediation progress to senior management.

Mentorship : Mentor and guide junior team members on DevSecOps best practices and security tools. Required Skills & Qualifications Experience: 5-6 years of relevant experience with Application Security, or a similar role, preferably within the Banking or NBFC sector. Technical Proficiency: Extensive, hands-on experience with SAST, SCA (open source) and DAST tools as listed above.

Security Knowledge: In-depth understanding of application security vulnerabilities, including OWASP Top 10, and common attack vectors. Pipeline Knowledge : Working Knowledge of CI/CD pipelines and experience integrating security tools into them. VAPT : Proven experience in conducting and coordinating VAPT activities.

Problem-Solving: Excellent analytical and problem-solving skills with a keen eye for detail. Communication : Strong communication and interpersonal skills, with the ability to articulate complex security concepts to non-technical stakeholders.