Join EY's Global Delivery Services as a Senior Consultant in Cyber Security, focusing on DevSecOps and Application Security. This role is pivotal in embedding security throughout the software development lifecycle, from design to deployment. You will be instrumental in implementing secure coding practices, automating security measures within CI/CD pipelines, and ensuring robust application security for our clients.

Our Global Delivery Services network is a cornerstone of EY's growth strategy, providing specialized support across the globe. We are a rapidly expanding team committed to delivering innovative and high-quality services, enabling our clients and internal teams to thrive.

Implement and champion Secure SDLC (SSDLC) practices within application development and CI/CD pipelines. Conduct comprehensive application security assessments, including SAST, DAST, SCA, and basic threat modeling. Seamlessly integrate and automate security tools within CI/CD workflows, covering secret scanning, IaC scanning, and container security. Provide essential support to development teams on secure coding techniques, vulnerability remediation, and code reviews. Drive DevSecOps pipeline implementation and optimization utilizing enterprise and open-source technologies. Assist in critical threat modeling exercises (e.g., STRIDE) and secure design reviews. Develop custom scripts and automation solutions for security testing, reporting, and tool integration. Collaborate effectively with DevOps and cloud teams to implement robust security controls in cloud environments (AWS/Azure/GCP). Analyze complex security findings, generating detailed reports that outline risks, exploitation scenarios, and actionable remediation steps. Champion the adoption of container security, IaC security, and compliance-as-code methodologies. Contribute to innovative AI-assisted security use cases, enhancing automated triaging, code analysis, and developer productivity. Maintain a proactive stance on emerging security threats, vulnerabilities, and evolving DevSecOps trends.

Demonstrate strong, hands-on experience in application security testing methodologies, including SAST, DAST, and SCA. Possess proven experience working with CI/CD pipelines and a variety of DevOps tools such as Jenkins, Azure DevOps, GitHub, and GitLab. Exhibit proficiency in scripting and programming languages, including Python, PowerShell, and Java. Maintain a solid understanding of DAST tools (e.g., Burp Suite, WebInspect, AppScan), SAST/SCA tools (e.g., Checkmarx, Fortify, Veracode, Coverity), container security tools (e.g., Aqua, Invicti), and secret scanning tools (e.g., GHAS, Git Guardian). Exhibit a strong grasp of OWASP Top 10 vulnerabilities and secure coding best practices. Possess practical experience with major cloud platforms (AWS, Azure, GCP) and fundamental cloud security principles. Have exposure to container technologies like Docker and Kubernetes, along with their associated security tools. Understand DevSecOps principles and SSDLC frameworks, such as OWASP SAMM and NIST SSDF. Showcase hands-on experience with SCM tools (e.g., GitHub, GitLab, Bitbucket) and their pipeline integrations. Demonstrate a good understanding of threat modeling concepts, including STRIDE. Ideally, possess exposure to AI/ML or GenAI tools within development or security workflows. Exhibit strong problem-solving capabilities and the ability to collaborate effectively within cross-functional teams. Required Education: BE/B.Tech/MCA. Minimum 3 years of relevant work experience. Must hold at least one of the following certifications: Azure Security Architect (Az-500) or AWS Security Specialty Certification (SCS-C01). Knowledge of Windows, Linux, UNIX, or other major operating systems is essential. Proficiency in Excel and PowerPoint is required.