Tata Communications Redefines Connectivity with Innovation and IntelligenceDriving the next level of intelligence powered by Cloud, Mobility, Internet of Things, Collaboration, Security, Media services and Network services, we at Tata Communications are envisaging a New World of Communications
Broad Outline of the Role
Responsible for embedding application security across the SDLC, identifying and mitigating vulnerabilities, conducting security assessments, and driving DevSecOps initiatives. The role requires hands-on expertise in SAST, SCA, DAST, VAPT/Penetration Testing, Secure Code Review, Threat Modeling, and Application Security governance across web, mobile, API, microservices, and cloud-native applications.
Minimum Qualifications & Experience
- Bachelor’s/Master’s degree in Computer Science, Cyber Security, Information Security, IT, or related engineering discipline.
- 5–10 years of cybersecurity experience, including minimum 5 years in Application Security.
- Hands-on experience in SAST, SCA, DAST, VAPT, Secure Code Review, Threat Modeling, API Security, Secure SDLC, and CI/CD security integration.
- Strong knowledge of OWASP Top 10, OWASP ASVS, SANS Top 25, DevSecOps, Cloud Security, and vulnerability management.
- Experience in large enterprise, Agile, DevOps, and cloud-native environments, including management of security testing and vulnerability remediation.
- Working knowledge of Java, .NET, Python, JavaScript, Node.js, Go, YAML, Shell scripting, and Linux/Unix.
Other Knowledge & Skills
- Hands-on experience with Black Duck, Checkmarx, Snyk, Fortify, and Burp Suite Professional ; exposure to Veracode, SonarQube, OWASP ZAP, GitHub Advanced Security, Prisma Cloud, Qualys, Tenable, and Acunetix is advantageous.
- Knowledge of OWASP, NIST, ISO 27001, PCI DSS , secure development frameworks, security architecture, and emerging threats/vulnerabilities.
- Strong analytical, problem-solving, communication, documentation, stakeholder management, and cross-functional collaboration skills.
- Ability to assess security findings, identify false positives, prioritize risk, and provide practical remediation guidance.
- Preferred certifications: CSSLP, GWAPT, GWEB, CASE, OSCP, eWPT, CEH, CISSP, CCSP, Security+ , or equivalent.
- Self-driven, security-first mindset with continuous learning and ability to drive security adoption.
Key Responsibilities
- Perform manual and automated SAST, SCA, DAST, VAPT/Penetration Testing, and Secure Code Reviews across web, mobile, API, microservices, cloud-native, and enterprise applications.
- Identify, validate, prioritize, track, remediate, and retest vulnerabilities; provide secure coding and remediation guidance.
- Integrate and maintain security tools and security gates within CI/CD pipelines and drive shift-left/DevSecOps practices.
- Conduct/support Threat Modeling, Security Architecture Reviews, Application Risk Assessments, and secure design reviews .
- Collaborate with Development, QA, DevOps, Architecture, Cloud, and Security teams to embed security throughout the SDLC.
- Administer and optimize Application Security tools, applications/repositories, improve scan coverage, and reduce false positives.
- Develop and maintain Application Security policies, standards, procedures, baselines, and developer secure coding awareness/training.
- Ensure compliance with organizational requirements and OWASP, NIST, ISO 27001, PCI DSS , and applicable secure development standards.
- Track and report security posture, vulnerability aging/remediation, exceptions, trends, dashboards, and management metrics.
- Drive KPIs including Critical/High vulnerability reduction, remediation closure, assessment coverage, CI/CD security-gate adoption, SLA compliance, and secure coding compliance .
