JDs would range from junior to senior positions from few known organisations

This is to give you the idea that what are the different skill sets these companies are looking for. Skills and requirements might differ from company to company for the same job title and role. Service based companies require different skills than product based organisation and startups are at anothger level when finding a security resources 😜

Here are few AppSec Based JDs

Sr. Director, Application Security - Barracuda

The Sr. Director of Application Security (AppSec) oversees the safety and security of Barracuda Networks software and services through source code review, manual application security assessment, operation and integration of automated security assessment solutions, architecture review, and expert advice regarding software security trends, threats, best practices and incidents. Through assuring the safety and security of Barracuda Networks software and services, the Application Security Engineer helps to keep our customers and their data safe and secure.

This role will spend 60% of the time as an individual contributor doing manual code reviews and application assessments. The other 40% of the time is on the management of a functional area within the Office of Information Security, including team mentorship, program management, and building strategic app sec initiatives.

What You’ll Be Working On

• Lead, manage, and develop our geographically distributed application security team
• Ensure the secure delivery of software from design through to implementation
• Maintain awareness of software security trends, incidents, and best practices, and provide expert advice and guidance to engineering teams regarding secure development and vulnerability remediation.
• Manage Barracuda’s bug bounty programs
• Work collaboratively with the organization, including with Security, Compliance and Engineering, to understand and remediate computer and software security incidents
• Evaluate new and emerging security technologies, features, and products.

What You Bring To The Role

• 7+ years' experience working in an Application Security Engineer capacity
• Experience with manual code review or source code review, preferably for Python, PHP and Go
• A deep understanding of software security best practices and vulnerabilities, especially as they relate to web applications (e.g. OWASP Top 10)
• Experience identifying vulnerabilities in the design and implementation of software and SaaS services
• Ability to perform source code review in new and unfamiliar languages using knowledge of security best practices and a willingness to read documentation
• Ability to perform solutions architecture and design review
• Experience in scoping and performing manual application penetration testing
• Experience in assessing the risk of identified vulnerabilities, and providing correct, robust and actionable recommendations to mitigate and/or resolve the vulnerabilities
• Experience in understanding software vulnerabilities, in finding other instances of the vulnerability across codebases, and in identifying collateral/related vulnerabilities
• Experience in assessing the implemented resolution of a vulnerability for completeness and accuracy, and identifying bypasses for the implemented resolutions
• Experience in working collaboratively with software development teams to identify vulnerabilities in all stages of software development
• Experience in communicating effectively with people of varying security proficiency and interest (fellow security professionals, engineering, and management)
• The ability to coordinate and participate in wide-scale Software Incident Security Response exercises such as the log4j response, understanding and unpacking information as incidents unfold, and in working across the organization to deliver a comprehensive "Identify, Resolve, Validate" solution
• Basic programming experience in at least one language, preferably Python or Go
• Awareness of automated software security scanners such as SAST/DAST/SCA
• An understanding of cloud platform security concepts (preferably Azure and AWS)

What You’ll Get From Us

A team where you can voice your opinion, make an impact, and where you and your experience are valued. Internal mobility – there are opportunities for cross training and the ability to attain your next career step within Barracuda.

AppSec Architect/ Security Architect - Leadsquared

The Role LeadSquared is looking for Security Architect who has experience in Application/Product Security.

Key responsibilities include: · Manage all aspects of product security. · Responsible for application security. Ensure all open identified vulnerabilities are tracked to closure. · Manage overall cloud security posture and drive closure of open risks. · Perform risk assessments identifying all risk parameters pertaining to product, application and cloud infrastructure and work towards mitigating the same. · Help our customers with product and application security discussions. · Assist in customer and third-party information security audits. · Perform regular internal audits around product and application security, including infrastructure to identify potential gaps and work towards the closure. · Conduct training sessions for internal employees towards building a security culture in the organization. · Mitigate, manage, and resolve all audit findings and other security incidents. · Contribute towards product compliance against frameworks and legal requirements such as SOC2, HIPAA, GDPR, etc. · Staying current with latest trends, attack vectors, threats etc. · Be a part of internal security team and contribute to enhance overall product security.

Requirements: · 8+ years of experience managing product and application security. · Relevant application security certifications. · Excellent documentation, presentation, and training skills. · Must have outstanding communication skills (English). · Experience in product Risk and Incident management. · Working experience at a product-based company is a must. · Must have contributed towards enhancing overall product security. · Good knowledge on cloud native applications, SaaS applications and cloud service providers such as AWS. · Excellent understanding of OWASP/ SANS standards. · Experience in GRC is an added advantage.

Flipkart: Application Security - Senior Manager

Job Overview:

As the Application Security Leader at Flipkart, you will be responsible for leading a team of 15 skilled security engineers dedicated to testing and securing various applications and systems. Your primary focus will be on conducting secure design reviews, application testing (SAST, DAST), fine-tuning rules for the Web Application Firewall, and spearheading the implementation of DevSecOps practices throughout the application development lifecycle. Additionally, you will play a crucial role in training developers on secure coding practices and building a security champion program to promote a culture of security awareness across the organization.

As a Flipster you will be bringing cutting-edge approaches to solve business problems, create architecture & design to realize the solutions. You will interact with the Flipkart engineering, architect and tech teams to provide guidance, best practices and technical assistance in addressing application security issues.

Responsibilities:

• Lead and mentor a team of 15 security engineers, providing guidance, support, and fostering a collaborative work environment.
• Working with developers, designers, business analysts and product managers. In this role, application security manager will be responsible for the security governance and ensuring adherence to application security control and risk analysis in SDLC.
• Oversee and execute secure design reviews for new applications and system enhancements, ensuring adherence to industry best practices and security standards.
• Plan and conduct comprehensive application security testing, including Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), to identify vulnerabilities and weaknesses. - Manage and optimize rules for the Web Application Firewall (WAF) to enhance protection against potential threats and attacks.
• Collaborate with cross-functional teams, including developers, product managers, and IT operations, to integrate security measures seamlessly into the software development process.
• Champion the adoption of DevSecOps methodologies and tools at all stages of application development, enabling rapid, secure, and continuous delivery.
• Stay abreast of the latest application security trends, threats, and vulnerabilities, and proactively implement necessary measures to address potential risks.
• Develop and maintain documentation for application security standards, policies, and procedures. Collaborate with internal and external stakeholders to ensure compliance with industry regulations and standards related to application security.
• Develop and conduct security training programs for developers, equipping them with the knowledge and skills to implement secure coding practices and adhere to security guidelines. -

Qualifications:

• Bachelor's or Master's degree in Computer Science, Information Security, or a related field.
• Proven experience in application security, with a strong background in secure design, vulnerability assessment, and penetration testing.
• Prior experience in a leadership or managerial role, with the ability to effectively lead and develop a team of security engineers.
• Hands-on experience with Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tools.
• Familiarity with Web Application Firewall (WAF) technologies and rule tuning.
• Expertise in implementing DevSecOps practices and integrating security into CI/CD pipelines.
• Strong communication skills with the ability to interact confidently with technical and non-technical stakeholders.
• Industry certifications such as CISSP, CSSLP, are a plus.

Rippling: Staff Product Security Engineer

About Rippling Rippling is the first way businesses manage their HR & IT—payroll, benefits, computers, apps, and more—in one unified workforce platform.

By connecting every business system to one source of truth for employee data, businesses can automate the manual work they usually need to do to make employee changes. Take onboarding, for example. With Rippling, you can click a button and set up a new employee’s payroll, health insurance, work computer, and third-party apps—like Slack, Zoom, and Office 365—all within 90 seconds.

Based in San Francisco, CA, Rippling has raised $1.2B from the world’s top investors—including Kleiner Perkins, Founders Fund, Sequoia, Bedrock, and Greenoaks—and was named one of America’s best startup employers by Forbes (#12 out of 500).

About The Role We're looking for a hands-on staff security engineer to play a vital role in building Rippling's security program. Rippling's product’s scope provides a unique set of security challenges, but our management is especially supportive of security and compliance as a central business function. As an early member of Rippling's security team, you'll impact the security program’s priorities and direction.

What You'll Do

• Mentor software engineering teams in security best practices.
• Threat-model application designs and solutions and provide security assessments.
• Perform dynamic security testing on Rippling products
• Audit source code and perform code review for critical application changes
• Provide hands-on remediation guidance to development teams
• Review Establish software development practices that make security an essential part of the development process
• Develop / Integrate security into the Software Development Life Cycle

Qualifications

• 8+ years of experience in a product security role
• Experience leading architectural changes or complex cross-team efforts to mitigate security vulnerabilities
• Deep understanding of securing web applications - mandatory
• Fluency in Python, React, and Django Rest Framework
• Experience with manual source code review and embedding security to code in production environments - mandatory
• Experience with deploying application security tools in the CI/CD pipeline - good to have
• Experience with securing software development lifecycle, including manual and automated application security testing - desired

Bonus Points

• Good understanding of SSO, including OAUTH, SAML - take it seriously
• Experience with securing MDM software agents for Mac/Windows

Tesco: Senior Cyber Partner

Job Description

• This role is about transforming the way security is delivered within our engineering teams in Tesco Technology
• As our software and enterprise APIs continue the move to the cloud, we have different security challenges, and this role is to help teams navigate that change successfully
• The boundary between infrastructure and application has virtually disappeared and being secure means support through the entire SDLC from the ideas phase into threat modelling during design, during development then through to production and ops
• Developing strong security partnerships for Tesco Technology Security partnerships are about transforming the way security is delivered within our technology domains and software engineering teams
• We have different security challenges, and your role as a security partner is to actively champion positive security change within your product teams
• Job accountabilities On a day-to-day basis you will Provide engineering and product teams with direction and guidance for all security matters
• There is a whole security organisation to back you up, so that is not as scary as it sounds
• Help product teams deliver new business features securely while balancing and clearly articulating technical and business risk
• You will be expected to drive the deployment/integration of security capabilities into engineering teams within the product domain
• You will drive security initiatives such as developing security requirements, threat modelling, strengthening application security, vulnerability reduction, etc, with the engineering teams
• Reducing friction is paramount and we are all about fast feedback within existing workflows, not adding another console for a developer to check
• Support teams in a collaborative manner in matters of mobile application, web application, cloud and data security, with threat modelling, risk treatment and security advice across all security domains
• If you can raise a PR to resolve fix a security issue, do so
• Facilitate risk remediation but also challenge decisions and status-quo
• Facilitate in assurance activities like penetration testing, purple testing, app assurance
• Build quarterly/monthly roadmaps for security activities and plan them
• Be an evangelist for security, take part in strengthening Tesco s internal policies and standards
• Longer-term, the nature of the role also means you are expected to identify new problem spaces, propose fixes, engage across disciplines
• In other words, we want you to innovate and will give you the room to do so
• If you can think of ways to do security, faster, more 3 accurately, with greater consistency and at scale while minimising friction, you will be supported all the way

Qualifications

• Cloud security; security architecture; devops; engineering practices; threat modelling; etc.
• You will need To excel in this position, you need to bring the following: Solid security experience across common security domains the technology might have changed but most of the security challenges have not
• A thorough understanding of modern application development practices so that security capabilities can be introduced and embedded while minimising developer friction
• Excellent interpersonal, facilitation, and leadership skills along with effective communication (both written and verbal) skills
• Be able to provide security guidance to engineering teams throughout the product development lifecycle
• Be able to develop threat models, attack trees, and embed security by design in product engineering effort
• Good understanding of web technologies, REST APIs, micro services, modern application development, and mobile apps
• Good understanding of software architecture, dev-sec-ops, and network security
• Experience in browser security or mobile app security is desirable
• Good understanding of industry standards such as OWASP ASVS, OWASP Top-10, CIS benchmarks
• Hands-on experience with complex Azure and AWS architectures with an emphasis on containerised workloads
• Command-line/API experience is highly desirable as security automation is a strategic priority
• Some coding experience in something is always a plus - Java, HTML, JavaScript
• You do not need to be a developer but you do need to understand the implications of security on engineering velocity
• Knowledge of and experience with PCI-DSS will be desirable
• A minimum of 5 years of experience in security engineering or closely related areas
• Bachelors degree in Computer Science / Information Systems or Engineering discipline
• Azure or AWS cloud security certifications (preferred)

Employment Type: Full Time, Permanent

Cohesity - Staff Security Software Engineer, Bangalore

About This Role: We are actively seeking seasoned, senior trendsetters in a role as Staff Software Technical Leader, Security Products. As part of our Security Engineering team, you will be responsible for architecture, end-to-end system design from inception through product delivery and lifecycle of multiple security products in one or more of: Detection, Remediation, Prevention of any "kill-chain" at any stage. This can include research, development and delivery, partner integrations among but not limited to Malware, Ransomware, IAM, KMS, DSPM, CSPM, UEBA, SIEM/SOAR and many more.

Day-to-day role involves developing system security software service at a fast paced development environment in a hybrid cloud & on-prem deployment and continuously improving product security posture. The role will serve as a Security Specialist in cloud, container, Kubernetes security, coherence caching, control plane - data plane connectivity and associated security & hardening needs, scale-out DB & managed services, monitoring & metrics, hands-on with cloud-infra CI/CD tools, performant and efficient cloud backend development (full-stack would be a benefit), KMS, identify & access management.

You are working in lock step with cross-BU platform, cloud SaaS engineering and infrastructure teams, enabling and delivering security products in the ecosystem with monthly release cycles. Writing design specs, implementing the design, and communicating with stakeholders will be a regular part of the job. We're looking for an individual who is motivated by technology and enjoys problem-solving, mentoring, reviewing and collaborating with engineers (not as a people manager, but as their tech lead and architect.

Responsibilities ⦁ Architect, technically leads teams as a hands-on Principal to guide, mentor and deliver Cloud Security Products in SaaS distributed environments. This includes Anti-Ransomware solutions, AI/ML based attack vector analysis with solution & product design to address customer needs to ensure Data Security, Data Sovereignty. ⦁ Bring core value with current and innovative solutions for Cohesity leadership in securing customer data in hosted SaaS and enterprise environments. ⦁ Engineering, implementing and supervising security measures for the protection of Cloud Infrastructure and integrations ⦁ Perform security architecture reviews for Cloud Infrastructure for existing and new services ⦁ Conduct assessments of security controls and configuration and continuous verification with automation ⦁ Threat Modeling and Pen Testing of Cloud security Infrastructure & services ⦁ Design and implement Cloud Infrastructure Monitoring use cases ⦁ Implement and Manage Egress and Ingress security controls Network Firewall, WAF, DDoS ⦁ Perform Security training and outreach to internal development tools. ⦁ An advocate for policy of code, security, and automation. Embracing DevSec Ops towards all cloud activities ⦁ Design, develop, and implement system, container, and Cloud Security related product features (MUSTHAVE) ⦁ Deep understanding of Linux Internals, Containers, and Cloud security that can be efficient at running as On-Prem software or as SaaS on public clouds ⦁ Coordinate features and deliverables across multiple teams to achieve project goals ⦁ Collaborate with cloud operations to establish KPI for different services and own end to end delivery and lifecycle management ⦁ Lead initiatives and projects. Provide technical leadership and mentoring to team members. ⦁ An advocate for policy as a code, security, and automation.

Requirements ⦁ B.S. or M.S. in Computer Science, Electrical Engineering or related experience. ⦁ At least 12+ years of experience in Information Security including 4+ years of experience in Cloud Security. ⦁ Demonstrated success and influence in the Cloud Security space with relevant experience in one or more of: AD, WAF, Firewall, Intrusion Prevention, Data Encryption and Compliance needs. ⦁ Hands-on working experience in architecting/operating solutions and security frameworks built on AWS, Azure, or Google Cloud. ⦁ Meaningful experience in high level programming languages (Java, Python, C++, Go). ⦁ Experience defining security policy, technology requirements, and control objectives. ⦁ Experience in logging, monitoring, and responding to detected incidents in the cloud environment. ⦁ Ability to translate compliance requirements into technical controls. ⦁ Strong working experience in protecting databases, networks, and compute security controls including Docker / Kubernetes architecture and security configuration. ⦁ Deep understanding of Cloud Security fundamentals (Cloud networks and Cloud-based Systems), including cryptography and the shared responsibility model ⦁ Expert knowledge of secure infrastructure architectures, application architectures, encryption, Cloud Security and broader security technologies. ⦁ An interest and desire to stay abreast of emerging security threats, vulnerabilities, and controls. ⦁ Experience in implementing Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platforms (CWPP) is a plus ⦁ Experience working in a regulated environment (SOC, ISO, PCI, DSS, HIPAA, etc.) ⦁ Hands-on development experience using Cryptography algorithms, API / User Authentication, and authorization design and implementations ⦁ Strong cloud backend development experience in one or more of: Java, Golang, C++ ⦁ REST API and GRPC-based application development. ⦁ Deep understanding of Cloud Security (Cloud networks and Cloud-based Systems) ⦁ Motivated to solve complex problems and challenges. ⦁ Distributed systems design and development is plus ⦁ Strong analytical and problem-solving skills

Garett Advancing Motion

Cybersecurity Architect

About the job

Job Description

Cyber Security Architect role is responsible to drive "Secure by Design" strategy across Garrett. The role will enable security architecture solutions for IT Solutions deployed across Garrett IT and Manufacturing Plants IT landscape. The role will be responsible to drive reference architecture for a secure IT environment. The role will drive Cyber Security Architecture reviews to evaluate Enterprise IT architecture, identify Cyber Security risks & recommend mitigation approaches. Define and implement Cyber Security technology roadmap to integrate advanced technologies such as AI/ML, Blockchain, Quantum safe cryptography. Define defence in depth approaches for all functional IT areas, applications, software development, Dev-Ops, networking, end user computing, cloud, etc.

Responsibilities

• Security Architecture & Secure by Design
• Drive a standardized Security Architecture governance program to advance consistent architecture practices for all critical IT applications & infrastructure including Cloud SaaS services used in Garrett such as AWS, O365, Oracle HCM, On shape, Rescale, Salesforce, etc.
• Drive “Secure by Design" strategy to proactively build-in security practices across IT landscape including infrastructure & application architecture.
• Enable the right integration of Cyber security requirements in new programs, drive architecture reviews, security architecture risk assessments; studying architecture/platform; identifying integration issues.
• Define & drive Cyber security technology roadmaps to enable right level of threat detection and prevention capabilities for Garrett. Continuous focus on Security technology roadmap enhancements to integrate advanced technologies such as AI/ML, Blockchain, Quantum safe cryptography. Integrate best practices and strengthen cyber security systems by evaluating network and security technologies; developing security architecture requirements for networks (LAN/WANs/VPNs), routers, firewalls, and related security and network devices; designs public key infrastructures (PKIs), including use of certification authorities (CAs) and digital signatures as well as hardware and software; adhering to industry standards.
• Responsible to define Cyber Security Technology stack to support overarching Cyber Security Strategy & mitigate emerging cyber security threats.
• Responsible to define Cyber Security Reference Architecture for key use cases across all IT Strategic initiatives such as Data Lake, eCommerce, Parametric Design for Engineering, Cloud Security, DevOps, Containerization project unique to organization line of business and functional teams.
• Drive Cyber Advisories by analysing the latest threats from industry and providing concise advisories to Garrett stakeholders.
• Responsible to establish & deploy Security baseline configurations for datacentres, IT and Plant, WANs, routers, firewall and related network devices.
• Define defence in depth approaches for all functional IT areas, applications, software development, Dev-Ops, networking, end user computing, cloud, etc.
• Architecture reviews & OEM Customer interface
• Responsible to develop specific Cyber Security controls based on Automotive OEM customer requirements & drive implementation across IT & Manufacturing Plant OT environments.
• Responsible for defining and implementing Cyber Security controls and technology required by customer to enable right level of protection for sensitive & confidential data.
• Represent Garrett Cyber Security team with OEM Customers such as Daimler, GM, etc to develop confidence in Garrett's Cyber Security practices and collaborate in securing customer data and adherence to the customer requirements for security controls.
• Collaborate with stakeholders across Engineering, ISC, Common Functions, Sales & Marketing, Comms, etc to define & implement Cyber Security architecture solutions to meet Customer's Cyber Security requirements.
• Collaborate with Enterprise Architecture team to advance Cyber Security Architecture priorities.
• Review the security requirements, draft Threat Modelling for the architecture, document the Cyber Security requirements to mitigate the security risks with the system.
• Cloud Security Governance
• Global Responsibility for defining & driving Cloud Security governance program to meet business requirements for all SaaS services and other cloud services such as AWS, O365, On shape, Coupa, HR services and other critical services hosted on the cloud for the organizations.
• Be a critical decision-maker in selecting new cloud services by reviewing cloud security architecture before a new service is selected.
• Responsible for Cyber Security architecture & design solutions for applications hosted in AWS.
• Responsible for establishing & deploying Cyber Security baseline configurations for AWS.
• Collaborate with Enterprise Architecture to implement Cloud native Cyber security reference framework and knowledge repository. Create layered core, secondary and tertiary Cyber Security controls for implementing and executing cloud services.
• Secure Product Life Cycle
• Responsible for defining Secure product development life cycle & integration of security development practices into DevOps life cycle across IT & COV product development.
• Be proactive in evaluating the industry trends on new technologies and methods to advance Cyber Security architecture and technologies.
• Participate in the technical evaluation and testing of hardware and software for possible impact on systems security or for risk to intellectual property.
• Establish & report Cyber Security Architecture KPI metrics.
• Guide maintenance Up to date Security Policies and Procedures


Education / Qualifications

• Bachelor’s degree in information technology or related discipline
 Experience Required
• 15+ years of total experience & 10+ years of relevant experience in Cyber Security Architecture areas
• Possess leadership skills to be able to directly and or indirectly influence the business functions to successfully implement security projects.
• We have demonstrated proficiency with the IT Security Common Body of Knowledge required for enabling security concepts on varied technology.
• Demonstrated experience in maintaining common IT security technologies such as firewall, VPN, PKI, E-business and web technologies, vulnerability & risk assessment, intrusion detection, event correlation, DMZ, Extranet, etc.
• Intermediate to advanced knowledge of routing, switching, and bridging in LAN/WAN multi-national environments.
• Experience in Secure DevOps and container technology, experience on Cloud Security and technologies
• Collaborate with Cloud Security Architecture for an integrated security governance program for the organizations.
• Strong understanding of Cyber Security concepts
• Experience with performing or reviewing enterprise risk assessments.
• Experience with evaluating or writing security standards / baseline to meet compliance requirements.
• Ability to work independently with limited supervision.


Key Skills And Knowledge

• Expertise and demonstrated experience in architecting and deploying solutions serving operational and analytical needs from both an infrastructure (security controls, Endpoint security, Network Security, Active Directory, SIEM, Data Protection, Encryption, etc.) and data (securing and managing access to, conversion approaches, archiving, monitoring, etc)
• Experience in influencing customers and extended Project Teams
  • Communicating effectively in writing as appropriate for the needs of the audience
  • Good expertise Security architecture methodologies such as threat modelling, architecture reviews, etc
• Abreast of both old and new security vulnerabilities and continually keep up to date on the latest security best practices and technologies.
• Strong knowledge of cryptography as it relates to computer and network security as well as file and email encryption required.
• Proficiency in performing architecture reviews and ranking risks.
• Strong, demonstrated project management skills.
• A self-starter, with limited supervision & be able to work effectively in a global diverse environment.
• Review the security requirements, draft Threat Modelling
• Certifications like CISSP, CCSP are desirable.
• Maintains expert knowledge of Cyber security threats and risks, and constantly monitors and evolves system security posture to mitigate.

Benefits & Perks

• Competitive salary and an attractive benefits package.
• Extensive training programs.
• Hybrid Work Model – 2 days WFH
• Experienced leaders to support your professional development.
• Dynamic and international work environment.

One, Application Security Engineer

The Role As an Application Security Engineer, you'll be responsible for ensuring that One delivers secure and reliable applications at scale. By partnering with engineers to build security into the product from the ground up, creating engineering tools and workflows that test and validate artifacts, and actively developing security frameworks, you’ll be the champion of modern Application Security Engineering at One and have a direct impact on the security of all of our products. You’ll provide subject-matter expertise to product teams regarding security best practices, optimize our secure coding practices, and use offensive security techniques to harden our environment and help improve our overall security practices.

This role is responsible for:

• Ensuring the quality and security of our applications and products by guiding their development through the Secure Development Lifecycle (SDLC) process.
• Performing SAST/DAST and penetration testing on core application services, web applications, and mobile applications.
• Developing, maintaining, and extending our in-house application security and penetration testing automated testing framework.
• Developing safe libraries and hardening existing libraries and frameworks to eliminate classes of vulnerabilities.
• Ensuring SDLC practices are enforced via Infrastructure-As-Code (IaC) policies, wherever possible.
• Working closely with Engineering teams to validate the security posture of new features prior to production deployment.
• Triaging and validating security vulnerabilities found or reported, and serving as a subject-matter expert in AppSec to the Engineering team in identifying and implementing mitigation solutions.
• Refactoring and deploying secure libraries and frameworks across the code repository.
• Training engineers, architects, code reviewers, and others on secure coding practices.
• Contributing to application threat models.
• Constantly maintaining awareness of known vulnerabilities in application technologies used within One.
• Working with the Security and other engineering teams to maintain a security architecture that provides security controls throughout all platforms to mitigate risk, and to meet goals and regulatory requirements.
• Providing expertise around code-level security concerns during product development.

You Bring

• 9+ years of experience in security engineering, DevSecOps, and application development.
• Excellent knowledge of the CVSS, MITRE ATT&CK, and OWASP Top 10.
• Proficiency in TypeScript.
• Practical understanding of AWS and its core services (VPC, EC2, RDS).
• Demonstrated experience in modern application architecture and deployment practices.
• Practical understanding of NIST SP 800-218 (Secure Software Development Framework).
• Experience with Library/API/Framework development.
• Experience with integrating security scanning tools with CI/CD, Web Application pentesting, fuzzing and DAST.
• Expertise in verifying and measuring common security vulnerabilities, and demonstrated ability to communicate these concepts to technical and non-technical partners.
• Exposure to most of the following technologies: AWS, iOS, Android, Vault, Kubernetes, PKI, React, GraphQL, and Datadog.
• Knowledge of cryptography including algorithms, standards, and their practical applications such as x.509 certificates.
• Experience defining security architecture patterns and standards.
• Proficiency in modern security evaluation tooling (Burp, Wireshark, Kali et al.)
• Preferably, understanding of regulatory compliance concerns (GLBA, CCPA, PCI).
• The Triple H Factor: Humble, Hungry and Honest.
• An act-like-an-owner mentality. We have a bias toward taking action.

Executive Director- Security Engineering - Morgan Stanley

• Job Number:  3255692
• POSTING DATE:  Jul 18, 2024
• PRIMARY LOCATION:  Non-Japan Asia-India-Karnataka-Bengaluru
• EDUCATION LEVEL:  Bachelor's Degree
• JOB:  Engineering
• EMPLOYMENT TYPE:  Full Time
• JOB LEVEL:  Executive Director   DESCRIPTION Senior Technical Product Manager and Regional Delivery Leader (Cloud Security)

About Us Morgan Stanley is a leading global financial services firm providing a wide range of investment banking, securities, investment management and wealth management services. The Firm's employees serve clients worldwide including corporations, governments and individuals from more than 1,200 offices in 43 countries.

As a market leader, the talent and passion of our people is critical to our success. Together, we share a common set of values rooted in integrity, excellence and strong team ethic. Morgan Stanley can provide a superior foundation for building a professional career - a place for people to learn, to achieve and grow. A philosophy that balances personal lifestyles, perspectives and needs is an important part of our culture. Technology Technology is the key differentiator that ensures that we manage our global businesses and serve clients on a market-leading platform that is resilient, safe, efficient, smart, fast and flexible. Technology redefines how we do business in global, complex and dynamic financial markets. We have a large number of award winning technology platforms that help to propel our Firm’s businesses to be the top in the market. Our India technology teams are based in Mumbai and Bengaluru. We have built strong techno-functional teams which partner with our offices globally taking global ownership of systems and products. We have a vibrant and diverse mix of technologists working on different technologies and functional domains. There is a large focus on innovation, inclusion, giving back to the community and sharing knowledge

Team Description The Cloud Security team designs, develops and implements security solutions for the Morgan Stanley Cloud environments. The Cloud Security Product team ensures we deliver meaningful security outcomes, and partner successfully across the Morgan Stanley Enterprise Technology organizations.

In addition to core technical product management responsibilities, the individual in this role will serve as the overall cloud security engineering delivery leader in the region. This role requires an outgoing individual who can collaborate with empathy and communicate with clarity across a matrixed organization of technical staff, risk professionals and senior leaders.

Responsibilities:


• Lead customer and stakeholder discovery, and partnership.
• Drive the management, socialization, and evolution of the product roadmap.
• Enable the engineering team to work in an agile manner, with clear direction and feedback on priorities and deliverables.
• Ensure the end-to-end delivery of the product roadmap with collaboration across teams, including the identification and communication of dependencies and risks.
• Ensure product strategy is aligned and integrated within the Cloud Security strategy.
• Understand the industry and market your product is in and apply that knowledge to customer interactions and the product roadmap.
• Build and maintain customer community and engagement for the product.
• Champion the team's customer successes.
• Grow and develop the engineering organization in the region.   QUALIFICATIONS Required:
• Experience in building relationships and partnerships with key stakeholders.
• Experience in delivering outcomes in matrix organizations, influencing partners and stakeholders.
• Ability to facilitate collaboration across teams and roles.
• Strong attention to detail and quality, with excellent written and verbal communication skills.
• Experience in delivering within an agile development environment.

Desired:

• A technical background that enables probing conversations with customers and discussion with the product engineering team.
• Experienced in delivering products/solutions/services in Public / Private Cloud environments.
• Experienced working in large complex organizations within a highly regulated industry.
• Experienced within a modern software engineering environment and the software development lifecycle.

Morgan Stanley is an equal opportunities employer. We work to provide a supportive and inclusive environment where all individuals can maximize their full potential. Our skilled and creative workforce is comprised of individuals drawn from a broad cross section of the global communities in which we operate and who reflect a variety of backgrounds, talents, perspectives, and experiences. Our strong commitment to a culture of inclusion is evident through our constant focus on recruiting, developing, and advancing individuals based on their skills and talents.

Staff Security Engineer (Security Automation)

India - Bangalore Information Security /Full-time

Responsibilities:

• The candidate will work with the Product Security team to build, maintain and run necessary automation for security and compliance. The candidate will have the following core responsibilities:
• Lead, design & develop automated workflows using APIs to tackle vulnerability management gaps
• Research and Implement security-focused tools to defend our infrastructure & applications from risks. Adopt open source, enterprise security scanners to define & automate security development lifecycle processes at scale.
• Develop custom scripts to increase system efficiency and lower the human intervention time on any tasks. Ensure that security requirements and considerations are woven by automation into the development of each system
• Work closely with stakeholders to define and enforce security policies and access controls
• Improve security team efficiency through process automation
• Work in an agile team, pair programming, and support deliverables
• Collect & report metrics on automation effectiveness
• Collaborate with peers to integrate secure DevOps principles into CI/CD pipelines and automated builds
• Be a part of on-call PagerDuty rotations
• Drive continuous process feedback improvement

Skills And Experience Baseline:

• 10+ years of relevant experience
• Demonstrate coding skills in Python, Java Script, Node.js, React.
• Extensive experience with AWS cloud environment, using its APIs, Serverless Application Model (AWS SAM)  and Lambda functions
• Experience working with CI/CD (e.g., TeamCity, Jenkins) pipelines and associated tools. 
• Working knowledge of react, Kubernetes, Docker Containers

Flipkart : Security Aechitect

About the role: As a Security Architect, you will be responsible for designing, implementing, and maintaining the security infrastructure for our e-commerce platform. You will work closely with various teams to ensure that our systems are secure, compliant with industry standards, and capable of defending against modern threats.

Key Responsibilities:

1. Design and implement security architectures for new and existing e-commerce systems.
2. Develop and enforce security policies, standards, and best practices.
3. Conduct regular security assessments, including vulnerability scans and penetration tests.
4. Collaborate with IT, development, and operations teams to ensure secure software development and deployment practices.
5. Monitor security systems, logs, and alerts to detect and respond to security incidents.
6. Stay updated on the latest security threats, technologies, and industry trends.
7. Ensure compliance with relevant regulations and industry standards

Security by Design:

1. Integration of security practices into the software development lifecycle (DevSecOps).
2. Ensuring that new projects and initiatives consider security from the outset and adhere to secure design principles.

Robust Security Infrastructure:

1. Implementation of a secure and scalable architecture that effectively protects sensitive data and systems.
2. Successful deployment of security tools and technologies that monitor and defend against threats.

Cross-Functional Collaboration:

1. Effective collaboration with IT, development, operations, and other teams to foster a security-conscious culture.
2. Providing security guidance and support to various stakeholders within the organization.