Senior Engineer

We are hiring for SSDLC Sr. Engineer for a big company (Mumbai location).

Role: SSDLC Sr. Engineer

Experience: 3-5 years

Notice period: Immediate joiner

Reporting structure: Reports to the Platform Software Security Services Lead/Manager

• Experience in the following process areas: Secure SDLC Methodologies for Waterfall/ Agile software development (Mandatory)
• Security best practices like OWASP and NIST guidelines (Mandatory)
• Ability to perform security review of microservices architecture, API Security (Mandatory)
• Hands on experience on Source Code reviews - SAST solution (Mandatory)
• Hands on experience on Dynamic Application Security Testing - DAST (Mandatory)
• Hands on experience in Software Composition Analysis - SCA (Mandatory)
• Hands on experience in performing Tech Stack Review (Mandatory)
• Comfortable working in an environment that practices Agile development, engaging Product Owner and other stakeholders
• Good knowledge of Cloud platform/VMware
• Ability to identify vulnerabilities threat actors in the application cycle and communicate effectively to the stakeholders. Threat Modelling PASTA, STRIDE etc (Good to Have)
• Possesses ability to quickly understand the technical and functional aspects of the project to be able to communicate effectively with different stakeholders.
• Excellent written and verbal communication skills in English, high integrity, strong work ethic and ability to empathize with the customer.
• Ability to work effectively in a fast-paced, project-oriented environment
• Ability to prioritize and execute tasks
• Ability to handle sensitive and confidential information
• Strong analytical and problem-solving skills

• Perform security best practices review followed by Development team
• Perform SCA and report vulnerabilities and recommendations
• Perform Tech Stack review and report findings along with recommendations.
• Perform code review (supporting SAST Tool) and remove false positives if any, and report valid security issues to development team
• Perform DAST on the various applications and remove false positives if any, and report valid security issues to development team
• Contribution to RFP process and assist in Implementing SSDLC Tools.
• Escalate issues and risks and proactively takes ownership for resolution
• Track milestones and deliverables and provide regular status reporting to respective stakeholders

• CSSLP/CISSP/SSCP or equivalent certification are desirable (Good to Have).
• Application/API Security Threat Modelling/API Security product Implementations, Specialisation or OWASP certifications or Agile Certifications are a plus