Kyndryl
Noida, Uttar Pradesh, India Posted 2d ago
At Kyndryl, we run and reimagine the mission-critical technology systems that drive advantage for the world’s leading businesses. We are seeking an Application Security Subject Matter Expert with strong experience across multiple facets of application security and DevSecOps integration.
Key Responsibilities
Threat Modelling & Advanced Testing
Lead threat modeling workshops for critical applications and services.
Perform manual security testing to assess business logic, abuse cases, and advanced attack scenarios.
Validate and exploit high-risk findings from DAST tools such as Fortify WebInspect to confirm impact and reduce false positives.
Strong understanding of security integration for application and infra level security assessments in DevSecops pipeline.
Understanding of Containers, Microservices based applications security considerations.
Container security assessment knowledge.
Knowledge of cloud security aspects is also preferred.
Vulnerability Triage & Remediation
Provide second-level triage of critical and high-severity vulnerabilities identified across SAST and DAST.
Conduct in-depth discussions with application stakeholders to review critical findings, false positives, and exception requests.
Guide application teams in remediation planning, secure design alternatives, and architecture-level mitigations.
DAST & SAST Governance
Conduct DAST tool coverage reviews and evaluate feature utilization to maximize effectiveness.
Ensure SAST and DAST testing, reporting, and remediation SLAs are consistently met.
Track security metrics (coverage, SLA compliance, MTTR) and present insights to AppSec leadership.
Collaboration & Mentorship
Collaborate with development, DevOps, and product teams to embed AppSec controls in CI/CD pipelines.
Mentor and guide junior analysts (L1/L2) in vulnerability triage, secure coding, and manual testing techniques.
Contribute to security automation opportunities, improving efficiency of AppSec processes and tooling.
Stakeholder Engagement
Act as a trusted advisor and escalation point for application security issues.
Lead second-level report discussions with business and technical stakeholders for critical vulnerabilities.
Support secure design and architecture discussions for new initiatives and high-risk projects.
Requirements
8+ years of experience in Application Security spanning SAST, DAST, manual testing, and secure SDLC.
Proven experience in threat modeling, risk assessments, and secure design reviews.
Strong knowledge of OWASP Top 10, API Security Top 10, SANS Top 25, CWE, and emerging threat vectors.
Hands-on expertise in integrating security tools within DevSecOps pipelines.
Excellent stakeholder communication and leadership skills.
Preferred Qualifications
OSWE / OSCP / OSEP certifications.
CISSP / CSSLP certifications.
GWAPT / GWEB certifications.
Cloud security certs (CCSP, AWS Security Specialty, Azure SC-100).
Bachelor's degree in Computer Science, Information Technology, or related field.
