Security Engineer

Roles and Responsibilities :

• Maintain a risk-based view of the application portfolio, including application ownership, criticality, external exposure, sensitive-data use, and key integrations. Help prioritize application security activities toward the highest-risk applications, major technology changes, and business-critical services.
• Partner with application, architecture, and project teams to define practical security requirements and perform security design reviews for new applications and significant changes. Facilitate threat modeling for high-risk applications and externally exposed services, escalating specialized concerns to appropriate cybersecurity or technical teams.

• Provide practical secure coding guidance, reusable standards, and developer-facing support to help teams address common application vulnerabilities. Promote security awareness and incorporate secure development practices into normal engineering workflows without creating unnecessary delivery friction.

• Support the rollout, integration, and effective use of application security tooling, including SAST, SCA, secrets scanning, and targeted dynamic or API testing where appropriate. Work with delivery teams to tune results, reduce false positives, and focus remediation on exploitable or high-risk findings.

• Partner with engineering and platform teams to introduce proportionate security checks into existing source-control and CI/CD workflows. Support foundational repository controls, dependency visibility, secrets management, and secure build practices, while applying more advanced controls such as artifact signing, container scanning, or infrastructure-as-code checks only where the technology and risk justify them.

• Coordinate application-security findings through triage, ownership, prioritization, remediation tracking, and validation. Maintain clear risk-acceptance and exception records, including compensating controls and expiry dates. Support security assurance for vendor-managed, Power Platform, SAP/ERP-connected, and API-based solutions by coordinating with the relevant platform, vendor-risk, data, and architecture teams.

• Track coverage, remediation progress, exception aging, and adoption of key controls. Work closely with development, architecture, platform, vendor, data, and cybersecurity teams to improve standards, documentation, automation, and application-security maturity over time.

• Participate in tool evaluations, new security projects, and ongoing improvements to our tech stack.

• Share insights and updates with management—on tool performance, incidents, risks, and opportunities for improvement.

Job Requirements :

• 8-16 years of experience in IT Services & Consulting as a Security Engineer or related field.
• Strong understanding of automation technologies such as CI/CD pipelines.
• Proficiency in conducting security testing and vulnerability assessments using various tools (e.g., Nessus).
• Experience with programming languages like Python or Java; knowledge of secure coding practices.

Key Skills:

• Application Security and risk-based SSDLC
• Secure coding guidance, OWASP web and API risks
• SAST, SCA and secrets scanning
• CI/CD and source-control security, including GitHub governance
• Dependency and software supply-chain security
• API security and authentication/authorization concepts
• Remediation tracking, risk exceptions, and compensating controls
• Security metrics, evidence collection, and reporting
• Strong stakeholder communication across developers, architects, vendors, and business teams
• Scripting or automation for reporting and repeatable security processes