Job Description:

• Work independently or as a part of the team or as a project lead to deliver following:
• Development of application security program, policies, and processes
• Conduct security assessments and reviews
• Provide advisory services to development teams to build secure applications
• Implementation of scanning technologies (e.g. IBM Appscan, HP Fortify, Qualys etc.)
• Determine the risk profile of the applications by verifying application controls vs information security policy. 
• Perform analysis of all scans, both standalone and enterprise, and prepare a written report of analysis.
• Connect and leverage other resources in information security to ensure accurate assessment of security controls as needed.
• Assist product owners and technology staff with analysis and interpretation of information system vulnerabilities identified and offer necessary consulting help to remediate vulnerabilities
• Oversee and manage the documentation of flaws into risk registry and track remediation activities.
• Secure SDLC Advisory and Implementation: Conduct analysis of security controls considered to be implemented through development lifecycle, gap analysis (against standards and benchmarks), recommend security technology / process controls and project manage implementation.
• Assist in the generation of metrics to drive the continuous improvement program and present current state of security status to management team.
• Leverage, keep up-to-date on latest trends and develop application security expertise that is required to successfully assess application controls.
• Support internal practice development initiatives, including: improving tools, templates and techniques used to deliver engagements, conceptualize new services and solutions, development of technical papers and marketing collaterals.
• Project management of one or more projects to ensure quality deliverables are produced within timelines, scope and cost. Identify, report and manage project risk, including: escalations, scope creeps, resource issues, customer delays, etc.
• Support firm’s presales activities, such as attending presales calls, response to RFPs, solution engineering & presentations, effort estimation, staffing etc.