ERGO Technology & Services
Lead IT Security - Code Security Engineer
Lead IT Security code security engineer in ERGO's Group Technology vulnerability management team, performing secure code reviews of web, mobile, and backend apps, triaging SAST findings, and guiding developers on fixes. Core stack includes Java, JavaScript, Python, C/C++, SQL, ABAP, Swift and SAST tools like Checkmarx, Fortify, SonarQube; requires 7-9 years in application security.
- Compensation
- Not disclosed
- Location
- Mumbai (All Areas)
- Work setup
- Onsite
- Seniority
- Lead
- Employment
- Not specified
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- 7-9 years in Secure Code Review and Application Security
- Bachelor's or Master's degree in Computer Science/Engineering/IT (non-CS degree requires 7-9 years relevant experience)
- Perform secure code reviews for web, mobile, and backend applications
- Working knowledge of OWASP Top 10 (Web & API), SANS, and CWE standards
- Read and analyze codebases in Java, JavaScript, Python, C/C++, SQL, ABAP, Swift, or similar
- Hands-on experience with SAST tools such as Checkmarx, Fortify, SonarQube
- Knowledge of Secure SDLC and DevSecOps practices
- Familiarity with authentication, authorization, cryptography, and session management
- Review pull requests and CI/CD pipelines to detect security issues
- Validate and triage SAST findings, reduce false positives
- Participate in threat modeling and identify design-level security risks
- Provide actionable remediation guidance and secure coding examples to developers
Nice to have
- Industry certification such as CTPRA/CTPRP, CISM, CRISC, CISSP, CGEIT, or ITCM
- Strong written and verbal communication skills for explaining security risks to technical and non-technical stakeholders
- Ability to work in fast-paced, agile, cross-functional team environments
- Willingness to coach development teams on secure coding practices
- Proven experience managing business and partner relationships
- Excellent command of business English
- Good interpersonal, communication, and organizational skills with a proactive approach
- Ability to direct and guide teams as relevant
Full description
Role & responsibilities
- Within the central division Group Technology (GT) Vulnerability Management & Security Testing (IT1.6.4).
- Perform secure code reviews for web, mobile, and backend applications.
- Identify security vulnerabilities in line with OWASP Top 10, SANS, and CWE standards.
- Analyze and review code written in languages such as Java, JavaScript, Python, C/C++, SQL, ABAP, Swift, or similar.
- Review pull requests and CI/CD pipelines to detect and address security issues.
- Validate and triage SAST findings, including reducing false positives and prioritizing real issues.
- Provide clear, actionable remediation guidance to developers, including secure coding examples.
- Participate in threat modeling and identify design-level security risks.
- Collaborate with development, QA, and release teams throughout the development and release cycles.
- Contribute to the creation and maintenance of secure coding guidelines, standards, and best practices.
- Create and update documentation to support audits, compliance activities, and team training.
- Track identified vulnerabilities through their lifecycle to ensure timely remediation and closure.
- Prepare, document, and share test results and security assessment outcomes with stakeholders.
Key Accountabilities & Responsibilities:
- Manages the functions mailbox end to end, including triaging, prioritising, responding to queries, and escalating complex issues, ensuring clear and timely communication to stakeholders.
- Operates with a high degree of independence and ownership, acting as a trusted extension of leadership in day to day service delivery and stakeholder interactions.
- Functions as a proxy for the service lead for defined areas, representing the function with authority in meetings, communications, and decision making within established parameters.
- Independently drives service operations and coordinates cross functional activities, ensuring continuity of service and issue resolution during the service lead’s absence.
- Supports team success by contributing to continuous improvement.
Key Competencies & Skills required
Technical Skills:
- Knowledge of Secure SDLC (Secure Development Lifecycle) and DevSecOps practices.
- Experience performing secure code reviews and identifying common application security issues.
- Working knowledge of OWASP Top 10 (Web & API) and Common application vulnerabilities and their basic remediation approaches
- Hands-on experience with SAST tools such as Checkmarx, Fortify, and SonarQube.
- Familiarity with core security concepts, including authentication, authorization, cryptography, and session management.