Job Description:

• Work independently or as a part of the team or as a project lead to deliver following: Development of application security program, policies, and processes Conduct security assessments and reviews Provide advisory services to development teams to build secure applications Implementation of scanning technologies (e.g. IBM Appscan, HP Fortify, Qualys etc.)
• Determine the risk profile of the applications by verifying application controls vs information security policy.
• Perform analysis of all scans, both standalone and enterprise, and prepare a written report of analysis.
• Connect and leverage other resources in information security to ensure accurate assessment of security controls as needed.
• Assist product owners and technology staff with analysis and interpretation of information system vulnerabilities identified and offer necessary consulting help to remediate vulnerabilities
• Oversee and manage the documentation of flaws into risk registry and track remediation activities.
• Secure SDLC Advisory and Implementation: Conduct analysis of security controls considered to be implemented through development lifecycle, gap analysis (against standards and benchmarks), recommend security technology / process controls and project manage implementation.
• Assist in the generation of metrics to drive the continuous improvement program and present current state of security status to management team.
• Leverage, keep up-to-date on latest trends and develop application security expertise that is required to successfully assess application controls.
• Support internal practice development initiatives, including: improving tools, templates and techniques used to deliver engagements, conceptualize new services and solutions, development of technical papers and marketing collaterals.
• Project management of one or more projects to ensure quality deliverables are produced within timelines, scope and cost. Identify, report and manage project risk, including: escalations, scope creeps, resource issues, customer delays, etc.
• Support firm’s presales activities, such as attending presales calls, response to RFPs, solution engineering & presentations, effort estimation, staffing etc.