Be an Early Applicant
The Role
Execute SAST, SCA, secrets detection, and DAST assessments; validate vulnerabilities, manage false positives and remediation SLAs, and integrate security scanning into CI/CD pipelines. Oversee SBOMs, dependency risks, CVEs, and application security metrics. Collaborate with development, DevSecOps, and platform engineering teams to remediate findings, optimize tools, produce reports, and promote secure coding practices.
Summary Generated by Built In
Application Support Engineer (SAST & DAST, DevSecOps)
Experience: 7-12 years
Location: Bangalore/Hyderabad/Pune
Summary
This pivotal role focuses on strengthening enterprise application security by leveraging a comprehensive suite of testing methodologies, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), Secrets Detection, and Dynamic Application Security Testing (DAST). The successful candidate will act as a catalyst for embedding security into the Software Development Life Cycle (SDLC), ensuring seamless integration within CI/CD workflows. By overseeing vulnerability validation, managing Software Bill of Materials (SBOM), and driving risk-based remediation strategies, this position is essential for maintaining robust security postures and delivering actionable security metrics to stakeholders.
Responsibilities
- Execute ongoing and targeted security assessments utilizing advanced SAST, SCA, Secrets Detection, and DAST technologies.
- Analyze security alerts to verify accuracy, filter out false positives, and assist development teams in resolving identified vulnerabilities.
- Embed automated security scanning mechanisms directly into CI/CD pipelines to enforce strict secure development gates.
- Oversee the creation of SBOMs, monitor open-source dependency risks, track Common Vulnerabilities and Exposures (CVEs), and generate reports on vulnerability exposure.
- Monitor and manage remediation Service Level Agreements (SLAs), Turnaround Time (TTD), and Time to Remediate (TTR) metrics alongside key application security performance indicators.
- Collaborate closely with development, DevSecOps, and platform engineering units to facilitate effective remediation and foster a culture of continuous security enhancement.
- Contribute to security evaluation efforts, optimize scanning tools, produce executive reports, and lead initiatives to empower developers with security best practices.
Requirements
- Possess between 2-6 years of professional experience within Application Security, Secure SDLC frameworks, or DevSecOps environments.
- Demonstrate practical expertise in managing enterprise-level AppSec scanning platforms and executing vulnerability management lifecycles.
- Show proven ability to integrate security testing protocols into CI/CD pipelines and cloud-native infrastructure.
- Maintain a deep understanding of the OWASP Top 10, secure coding standards, and the principles of software supply chain security.
Technical Skills & Tool Experience
- SAST: Proficiency with Checkmarx, Veracode, Fortify, SonarQube, or GitHub Advanced Security.
- SCA & SBOM: Experience utilizing Fortify, Checkmarx, Snyk, or Black Duck for dependency analysis.
- DAST & API Security: Hands-on knowledge of Fortify, Checkmarx, Burp Suite, Invicti, or Acunetix.
- Secrets Detection: Familiarity with GitGuardian or GitHub Secret Scanning capabilities.
- DevSecOps: Competence in Azure DevOps, GitHub Actions, Jenkins, or GitLab CI/CD.
- Container & Cloud Security: Knowledge of Prisma Cloud, Wiz, Aqua, or Microsoft Defender for Cloud.
- Reporting & ITSM: Skills in ServiceNow, Power BI, and Grafana for data visualization and ticket management.
Skills Required
- 2-6 years of professional experience in Application Security, Secure SDLC frameworks, or DevSecOps environments
- Practical expertise managing enterprise-level application security scanning platforms
- Experience executing vulnerability management lifecycles
- Ability to integrate security testing into CI/CD pipelines and cloud-native infrastructure
- Deep understanding of the OWASP Top 10
- Knowledge of secure coding standards
- Knowledge of software supply chain security principles
- Proficiency with SAST tools including Checkmarx, Veracode, Fortify, SonarQube, or GitHub Advanced Security
- Experience with SCA and SBOM tools including Fortify, Checkmarx, Snyk, or Black Duck
- Hands-on knowledge of DAST and API security tools including Fortify, Checkmarx, Burp Suite, Invicti, or Acunetix
- Familiarity with GitGuardian or GitHub Secret Scanning
- Competence with Azure DevOps, GitHub Actions, Jenkins, or GitLab CI/CD
- Knowledge of Prisma Cloud, Wiz, Aqua, or Microsoft Defender for Cloud
- Skills in ServiceNow, Power BI, and Grafana
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
2COMS is an India-based recruitment and manpower consultancy that helps organizations meet workforce needs through leadership hiring, general and IT staffing, apprenticeship management, international recruitment, gig workforce solutions, payroll and compliance, and HR technology. The company serves employers across industries while connecting job seekers with domestic and global opportunities through technology-enabled, end-to-end workforce and talent-management services.
