Assistant Manager - Global Information Security

Broad Outline of the Role

Responsible for embedding application security across the SDLC, identifying and mitigating vulnerabilities, conducting security assessments, and driving DevSecOps initiatives. The role requires hands-on expertise in SAST, SCA, DAST, VAPT/Penetration Testing, Secure Code Review, Threat Modeling, and Application Security governance across web, mobile, API, microservices, and cloud-native applications.

Minimum Qualifications Experience

• Bachelors/Masters degree in Computer Science, Cyber Security, Information Security, IT, or related engineering discipline.
• 510 years of cybersecurity experience, including minimum 5 years in Application Security.
• Hands-on experience in SAST, SCA, DAST, VAPT, Secure Code Review, Threat Modeling, API Security, Secure SDLC, and CI/CD security integration.
• Strong knowledge of OWASP Top 10, OWASP ASVS, SANS Top 25, DevSecOps, Cloud Security, and vulnerability management.
• Experience in large enterprise, Agile, DevOps, and cloud-native environments, including management of security testing and vulnerability remediation.
• Working knowledge of Java, .NET, Python, JavaScript, Node.js, Go, YAML, Shell scripting, and Linux/Unix.

Other Knowledge Skills

• Hands-on experience with Black Duck, Checkmarx, Snyk, Fortify, and Burp Suite Professional; exposure to Veracode, SonarQube, OWASP ZAP, GitHub Advanced Security, Prisma Cloud, Qualys, Tenable, and Acunetix is advantageous.
• Knowledge of OWASP, NIST, ISO 27001, PCI DSS, secure development frameworks, security architecture, and emerging threats/vulnerabilities.
• Strong analytical, problem-solving, communication, documentation, stakeholder management, and cross-functional collaboration skills.
• Ability to assess security findings, identify false positives, prioritize risk, and provide practical remediation guidance.
• Preferred certifications: CSSLP, GWAPT, GWEB, CASE, OSCP, eWPT, CEH, CISSP, CCSP, Security+, or equivalent.
• Self-driven, security-first mindset with continuous learning and ability to drive security adoption.

• Key Responsibilities
• Perform manual and automated SAST, SCA, DAST, VAPT/Penetration Testing, and Secure Code Reviews across web, mobile, API, microservices, cloud-native, and enterprise applications.
• Identify, validate, prioritize, track, remediate, and retest vulnerabilities; provide secure coding and remediation guidance.
• Integrate and maintain security tools and security gates within CI/CD pipelines and drive shift-left/DevSecOps practices.
• Conduct/support Threat Modeling, Security Architecture Reviews, Application Risk Assessments, and secure design reviews.