Lead - Information Security/Senior Lead - Information Security

Job description

**Location Name:** Pune Corporate Office - Mantri **Job Purpose** “This position is open with Bajaj Finance Ltd.” **Duties And Responsibilities** - Developing Security Strategies: Create and implement comprehensive security strategies for all applications within the organization, ensuring alignment with business objectives and compliance requirements. - Risk Assessment and Management: Conduct thorough risk assessments to identify potential security vulnerabilities in applications. Develop and implement risk management strategies to mitigate identified risks effectively. - Security Architecture Design: Design robust security architectures for applications, considering industry best practices and emerging threats. Ensure that security measures are integrated into the application development lifecycle. - DevSecOps: Support DevSecOps process by taking ownership of Security aspects in development lifecycle. - Security Testing and Assessment: Oversee the implementation of security testing processes, including vulnerability assessments, penetration testing, API security, red teaming and code reviews. Analyse test results and provide recommendations for remediation. - Incident Response and Management: Develop incident response plans and procedures for addressing security incidents related to applications. Lead incident response efforts, including containment, investigation, and resolution. - Cyber Fraud Management: Collaborate with Enterprise Fraud Management Team for minimising Cyber Frauds across Consumer and Enterprise Apps. - Cyber Exposure Management: Supporting sustenance operations for discovery threats on Surface Web, Dark Web, Phishing Websites, Malicious Apps and takedown efforts. - Security Awareness and Training: Develop and deliver security awareness programs to educate employees about application security best practices and promote a culture of security throughout the organization. - Security Code Review and SBOM: Engineer and Run the established practices of secure coding practices compliance. Run the operations of secure code reviews and SBOM, along with remediation tracking of the reported issues. - Compliance and Regulatory Alignment: Ensure that application security practices align with relevant industry regulations and compliance requirements. Stay abreast of regulatory changes and update security practices accordingly. - Vendor and Third-Party Risk Management: Evaluate the security posture of third-party applications and vendors to assess potential risks. Develop strategies for managing and mitigating third-party security risks. - Collaboration and Communication: Collaborate with cross-functional teams, including developers, engineers, and business stakeholders, to integrate security into the application development process. Communicate security risks and recommendations effectively to executive leadership. - Continuous Improvement: Stay current with the latest trends, technologies, and threats in application security. Continuously assess and enhance security processes and controls to adapt to evolving threats. **Required Qualifications And Experience** - Engineering / Computer Graduate with 10-15 years of Application / Cyber Security Experience - Experience from BFSI & Fintech Industry with exposure to regulatory requirements. - Experience in Consumer facing app ecosystem - Experience in Managing mid-Size Team - Relevant Security Certifications like CEH, CPENT, PNPT, EJPT, EWPT, OSCP etc. preferred. - Prior experience of Security Testing, OWASP Top 10 and application security - Prior experience of Penetration Testing Web Application, Mobile Applications and API Security testing - Sound in latest application technologies and network attacks execution - Good Written and Verbal Communication with Presentation Skills - Good Team Player and sound in stakeholder management - Threat Modelling, Cloud Security and WAF basics clarity - DevOps / DevSecOps and Source Code security review experience is added boon - Well versed with related tools and techniques of all the above - Security Testing of AI implementation and LLM security attacks would be added boon