Join EY's Global Delivery Services team as a Senior Consultant in Cyber Security, specializing in DevSecOps and Application Security. This role is pivotal in embedding security throughout the software development lifecycle, from design to deployment.

You will implement and support Secure SDLC (SSDLC) and DevSecOps practices, ensuring security is integrated into every stage. Your expertise will be crucial in performing hands-on security assessments and collaborating with development, DevOps, and architecture teams to enhance security within CI/CD pipelines.

This is an exciting opportunity to work on end-to-end DevSecOps initiatives, driving security automation and contributing to advanced application security practices.

- Implement and champion Secure SDLC (SSDLC) practices throughout application development and CI/CD pipelines. - Conduct comprehensive application security assessments, including SAST, DAST, SCA, and basic threat modeling. - Integrate and automate security tools within CI/CD workflows, covering secret scanning, IaC scanning, and container security. - Guide development teams on secure coding, vulnerability remediation, and code review processes. - Develop and optimize DevSecOps pipelines using both enterprise and open-source tools. - Facilitate threat modeling exercises (e.g., STRIDE) and secure design reviews. - Create scripts and automation for security testing, reporting, and tool integration. - Collaborate with DevOps and cloud teams to implement robust security controls in AWS, Azure, and GCP environments. - Analyze security findings, generating detailed reports with risk assessments, exploitation scenarios, and remediation strategies. - Support the adoption of container security, IaC security, and compliance-as-code methodologies. - Contribute to AI-assisted security use cases, enhancing automated triaging, code analysis, and developer productivity. - Stay abreast of emerging security threats, vulnerabilities, and the latest DevSecOps trends.

- Possess strong hands-on experience in application security testing methodologies like SAST, DAST, and SCA. - Demonstrate experience working with CI/CD pipelines and various DevOps tools such as Jenkins, Azure DevOps, GitHub, or GitLab. - Exhibit proficiency in scripting and programming languages including Python, PowerShell, or Java. - Familiarity with a range of security tools such as Burp Suite, Checkmarx, Fortify, Veracode, Aqua, Invicti, and GHAS Git Guardian. - Solid understanding of OWASP Top 10 principles and secure coding best practices. - Experience with major cloud platforms (AWS, Azure, GCP) and fundamental cloud security concepts. - Exposure to container technologies and their associated security tools (Docker, Kubernetes). - Understanding of DevSecOps principles and SSDLC frameworks like OWASP SAMM and NIST SSDF. - Hands-on experience with Source Code Management (SCM) tools and pipeline integrations. - Good grasp of threat modeling concepts, including STRIDE. - Exposure to AI/ML or GenAI tools in development or security workflows. - Exhibit strong problem-solving capabilities and the ability to thrive in cross-functional team environments.

To qualify, candidates must hold a BE/B.Tech/MCA degree and possess a minimum of 3 years of relevant work experience. A mandatory certification from the following list is required: Azure Security Architect (Az-500) or AWS Security Specialty Certification (SCS-C01). Proficiency in Windows, Linux, UNIX, and other major operating systems is essential, along with strong Excel and PowerPoint skills.