Senior Cyber Security Specialist

Overview

Senior Cybersecurity Specialist to manage the design, implementation and continuous improvement of cybersecurity controls for digital products and solutions in the Motion Business Service Division, reporting to the R&D Team Lead.

What you'll do

• Own the secure software development lifecycle and guide the product team to implement security practices at each stage of the software development process.
• Own software supply chain security, including defenses against risks from open-source packages, third-party binaries, container base images, build tools and other software dependencies.
• Own first-party software security, including code and container scanning, automated security testing in CI, external penetration tests, and the integrity and provenance of software built and published.
• Own and run the responsible vulnerability disclosure program, including triaging external reports, maintaining submission quality standards and scaling the review process.
• Partner with engineering teams from concept through implementation to conduct security design reviews, define secure architectures and ensure security best practices are followed.

What you'll need

• 10+ years of experience across software engineering, application security, security engineering or product security.
• Deep knowledge of Secure SDLC, Secure by Design, Secure by Default, OWASP, ISO 27001, NIST SP 800-53 and IEC 62443-4-2 standards.
• Experience conducting secure design and architecture reviews, developing reusable security reference architectures and security blueprints aligned with Microsoft Security Baselines and Bow-Tie models, and performing product security risk assessments.
• Proficiency in STRIDE, DREAD, PASTA and MITRE ATT&CK frameworks, with experience using tools such as IriusRisk and Microsoft Threat Modeling Tool to identify threats, assess risks and define mitigations.
• Practical experience integrating security into CI/CD pipelines, including SAST (SonarQube, WizCode), SCA (Black Duck Hub), DAST and vulnerability scanning (Nmap, Nessus, Qualys, Burp Suite), and SBOM generation and management using OWASP Dependency-Track.
• Deep understanding of cloud-native architectures, microservices, Kubernetes, containers and multi-tenant SaaS environments, with practical knowledge of security controls across Microsoft Azure, AWS and GCP.
• Solid knowledge of OpenID Connect, OAuth 2.0, SAML and mTLS, along with cryptographic protocols and algorithms such as TLS, AES, RSA, ChaCha20-Poly1305, SHA, ECC and Diffie-Hellman key exchange.
• Proven experience in vulnerability triaging, coordinated vulnerability disclosure, product risk remediation and GRC activities aligned with ISO 27005, NIST SP 800-37, SOX, GDPR, the Cyber Resilience Act (CRA) and IEC 62443.
• Bachelor's degree in Computer Science or a related field, with demonstrated ability to influence engineering and product leadership, define security policies and secure coding standards, deliver security awareness and secure coding training, and communicate technical risks effectively to executive stakeholders.

Details

• Location: Bangalore, India.
• Work model: Hybrid.