Vulnerability Management ( EVM)

Role: EVM Analyst

Exp: 6 to 10yrs

Location: Mumbai

Required Skill set:

• SAST -SonarQube, Fortify, checkmarks, Veracode ,etc.
• DSAT - OWASP ZAP DAST, BurpSuite, Web inspect, Appscan,etc Dependency-check (Jira plugin), Acquintex
• Vulnerability management tools - Nessus, Qualys, etc.
• Pentest KaliLinux, Metasploit,etc.
• Relevant certification (OSCP,CEH)
• Development experience in Python, Perl,Php will be added advantage.

Responsibility of / Expectations from the Role

CI/CD integration of SAST(SonarQube,Fortify,checkmarx,Veracode etc) and DSAT tools (OWASP ZAP DAST,Webinspect,Appscan,etc Dependency-check (Jira plugin) and Vulnerability management tools such as(Nessus,Qualys,etc)

Automate and integrate application and system cybersecurity controls as tollgate into development lifecycle.

Conduct application Security on manual and automated assessments

Perform network penetration testing, system vulnerability assessment & Security configuration review.

Excellent understanding of web application security and secure coding.

Application and Infrastructure Security Management for DevSecOps

Assist to set up DevSecOps framework and coordination with multiple Scrum Development Team

Leverage existing tool for SCA which is already integrated with Jenkins.

Configuration of scanning policy as per enterprise security check gate guidelines

Troubleshooting of scanning & integration issues

Apps to be onboarded on Release basis in DevSecOps environment

Auto-triggered SAST and DAST scans (release based) as a part of CI/CD pipeline

Tools Management / configuration of DevOps security tools (lifecycle, maintenance, updates, etc.)

Knowledge of SSL certificate and should have SSL certificate for the organization.

Vulnerability analysis, False positive removal, risk-based prioritization of vulnerabilities & Remediation assistance