Senior Analyst

Marmon Technologies India Private Limited

As a part of the global industrial organization Marmon Holdings—which is backed by Berkshire Hathaway—you’ll be doing things that matter, leading at every level, and winning a better way. We’re committed to making a positive impact on the world, providing you with diverse learning and working opportunities, and fostering a culture where everyone’s empowered to be their best.

Under general direction, responsible for the maintenance of installed infrastructure technologies as well as the installation and configuration of these technologies within specific area. Develops design and functional specifications, produces deliverables related to specific projects and assists in post implementation support and system enhancements. May be involved with the configuration and maintenance of physical and logical network components. Additionally, this position may play an integral role in more complex system integration testing and evaluation within specific technology area of responsibility. Incumbent may mentor and oversee the work of other analysts. Role typically requires more than 5 years of experience.

Job Title: Senior Security Engineer

Shift Timings: General Shift Role

Summary:

The Senior Security Engineer will lead application security engineering across the software development lifecycle. Strong hands-on SAST and DAST scanning experience is required, with primary ownership of DAST operations, SAST engineering, penetration testing, vulnerability remediation and DevSecOps enablement. The role will embed security into design and development, integrate security testing into Secure by Design (SBD), GitHub, Azure and CI/CD workflows, and work closely with development, QA, DevOps, cloud, and product teams to ensure security controls are implemented before production release.

Key Responsibilities:

Application Security & Secure by Design

• Embed security requirements, threat considerations, secure coding practices, and control validation across design, development, testing, deployment, and maintenance phases.

• Work directly with development teams to identify security gaps early and provide practical remediation guidance while applications are being built.

• Define and maintain security gates, minimum control requirements, exception handling, and evidence expectations for application releases. SAST, DAST & Penetration Testing - Technical Responsibilities

• Own the implementation, configuration, administration, tuning and continuous improvement of enterprise SAST and DAST capabilities.

• Configure, operate and optimize Invicti for authenticated and unauthenticated DAST scans, including scan profiles, authentication, scheduling, coverage, validation, reporting, retesting and troubleshooting.

• Perform SAST scan onboarding and configuration, validate code-level findings, analyze data flows and sources/sinks, tune rules, suppress verified false positives with evidence and provide developer-ready remediation guidance.

• Plan and execute web application, API and network-focused penetration tests using approved methodologies and tools; document reproducible evidence, risk ratings, business impact and corrective actions.

• Triage and correlate SAST, DAST and penetration-testing findings; validate exploitability, remove duplicate or false-positive results, prioritize risk and confirm closure through rescans and retesting.

• Monitor technical scan performance, including scan completion, coverage, authentication success, scan failures, false-positive rates, recurring findings, test effectiveness and remediation trends. DevSecOps, CI/CD, Azure & GitHub Security

• Integrate approved SAST and DAST controls into Secure by Design processes, GitHub repositories, pull requests, build workflows, CI/CD pipelines and release gates.

• Partner with DevOps and engineering teams to implement automated security scans, quality gates, severity thresholds, break-build criteria, and risk-based exception workflows.

• Administer and monitor security controls across GitHub and Azure development environments, including code scanning, secret scanning, dependency alerts, repository security settings, pipeline findings and cloud security configurations.

• Enforce branch protection, mandatory reviews, least-privilege access, environment separation, secure secrets handling and controlled promotion to production.

• Investigate scan and integration failures and retain security evidence for release governance and audit requirements. Vulnerability Management & Remediation

• Manage the end-to-end application vulnerability lifecycle: identification, validation, prioritization, assignment, remediation tracking, retesting, closure and reporting.

• Drive SLA-based remediation with development owners, escalate overdue risks, support documented risk acceptance where justified and verify fixes through rescans or retesting.

• Maintain dashboards and metrics covering vulnerability aging, severity, closure performance, recurrence, scan coverage and application risk posture. Collaboration, Governance & Continuous Improvement

• Act as the application security partner for developers, architects, QA engineers, DevOps teams, product owners, cloud teams and infrastructure teams.

• Deliver secure coding guidance, developer awareness sessions, tool onboarding and knowledge-sharing based on observed vulnerability patterns.

• Contribute to application security standards, procedures, checklists, playbooks, audit evidence and continuous improvement initiatives.

• Evaluate emerging AppSec and DevSecOps capabilities and recommend improvements that increase coverage, automation, accuracy and remediation speed.

Required Qualifications

• Bachelor’s degree in Computer Science, Information Security, Engineering or a related discipline or equivalent relevant experience.

• Minimum 5–8 years of hands-on cyber security experience, with strong focus on application security, DevSecOps, vulnerability management or penetration testing.

Required:

Strong hands-on experience implementing, configuring, operating, tuning and troubleshooting both SAST and DAST solutions in enterprise software development environments.

Hands-on experience with Invicti or a comparable enterprise DAST platform, including authenticated scanning, scan configuration, validation, tuning, reporting, troubleshooting and retesting.

• Hands-on experience integrating security scanning into GitHub pull-request workflows, Azure or equivalent cloud development environments, build systems, and CI/CD pipelines.

• Working knowledge of Azure security concepts, GitHub security capabilities, source control governance, secrets management, and secure deployment practices.

• Strong understanding of OWASP Top 10, secure SDLC, common web and API vulnerabilities, risk methodologies. rating, remediation techniques and penetration-testing

• Ability to interpret code-level findings and collaborate with developers on remediation across at least one common language or framework.

• Experience managing remediation SLAs, exceptions, evidence, dashboards, metrics, and stakeholder reporting.

• Clear written and verbal communication skills, including the ability to explain technical risks and corrective actions to both engineering and non-technical stakeholders. Preferred Skills and Certifications

• Experience with additional SAST, SCA, container, API or cloud-native security tools.

• Exposure to tools and platforms such as GitHub Advanced Security, Azure DevOps, Jenkins, GitHub Actions or equivalent technologies.

• Familiarity with threat modeling, security architecture reviews, software supply-chain security, SBOM practices, and compliance frameworks.

• Relevant certifications such as OSCP, OSWE, GWAPT, CSSLP, , CEH, Microsoft Azure Security Engineer Associate or equivalent AppSec / penetration-testing credentials.

Following receipt of a conditional offer of employment, candidates will be required to complete additional job-related screening processes as permitted or required by applicable law.