Security and GRC Specialist - 5-10Yrs - Hyderabad

Job Description: Lead — Security, GRC & Application Security

Role Summary

This role leads Pragma Edge's end-to-end security function — spanning governance/compliance, application security, cloud & infrastructure security, threat monitoring, and external attack surface management. The Lead owns the security posture across internal systems, client-facing products, and cloud/on-prem infrastructure, and is the primary point of accountability for audit readiness, client TPRM responses, and remediation across every layer of the stack.

Core Responsibilities

1. Governance, Risk & Compliance (GRC)

• Own and maintain security policies (Access Control, Incident Response, Data Protection, SDLC) — review and update on a recurring cycle.
  
• Conduct risk assessments and client Third-Party Risk Management (TPRM) reviews; maintain and update the Vanta risk register and track remediation to closure.
  
• Map controls to ISO 27001, SOC 2, NIST, and OWASP standards.
  
• Own audit evidence collection — logs, screenshots, approvals — for both internal and external audits.
  
• Lead quarterly internal audits (client-specific) and HR audits; own annual external audit and ongoing Vanta compliance management.
  

2. Application Security & Secure Development

• Perform secure code reviews on critical APIs and backend services.
  
• Own OWASP Top 10 remediation (BOLA, BFLA, Injection, Security Misconfigurations).
  
• Run Software Composition Analysis (SCA) — dependency vulnerability management, SBOM generation, license review, remediation validation.
  
• Own SAST scanning across JAR, Python, and Maven artifacts using Mend/WhiteSource; own DAST scanning (web app + API) using OWASP ZAP and Burp Suite.
  
• Run container/image vulnerability scanning (Mend CLI).
  
• Coordinate SAST/DAST/SCA findings with development teams, validate fixes, and perform rescans.
  

3. Penetration Testing

• Build and execute pentesting plans for web applications, APIs, and products.
  
• Own client communication throughout pentest engagements, produce findings reports, and drive remediation to closure.
  

4. Cloud & Infrastructure Security

• Review cloud IAM, network rules, and storage exposure; own security hardening (insecure configs, headers, TLS, secrets).
  
• Run infrastructure vulnerability assessments (Active Directory, switches, routers, internal servers) via Nessus.
  
• Run cloud compliance scans and client-specific AWS security/compliance assessments via Nessus.
  
• Own network security review, configuration validation, and hardening recommendations.
  
• Manage on-prem security: installation requests, firewall changes, domain whitelisting, and inbound/outbound IP access control.
  
• Validate backup, restore, and DR readiness; improve audit logging and SIEM integration.
  

5. Threat Monitoring & Security Operations

• Monitor security logs (Trend Micro) and firewall logs (Sophos) — event review, traffic analysis, and investigation.
  
• Coordinate remediation with Infrastructure, Cloud, Networking, and Development teams; produce vulnerability reporting across infrastructure, cloud, application, and product layers.
  

6. External Attack Surface Management

• Run weekly public IP discovery and maintain external asset inventory.
  
• Perform external reconnaissance, port scanning, and service enumeration.
  
• Own subdomain enumeration, takeover validation, and DNS verification.
  
• Run external vulnerability scanning and validation; monitor for exposed company-sensitive information on the internet.
  

7. Training, Awareness & Documentation

• Run security awareness training and phishing simulations; run developer secure-coding sessions (OWASP/API security).
  
• Prepare security assessments, training plans, test evaluations, and score analysis.
  
• Own compliance documentation: Access Change Requests, Device Disposal records, Incident Response documentation, Tabletop Exercise (TTE) documentation.
  
• Own security documentation: policies, assessment reports, remediation reports.
  
• Provide audit support: quarterly evidence, compliance reporting, vulnerability tracking, and exit-access revocation verification.
  

Requirements