USI - FY25|R&FA|Cyber - DevSecOps - Architecture Review| Senior Consultant

About this role

• Oversees projects, guides the team on a day-to-day basis and ensures that assigned tasks and responsibilities are fulfilled in a timely fashion
• Demonstrates understanding of business and information technology service management processes
• Deep knowledge of application security engineering principles and helping client’sdevelopment team to follow secure development practices which includes primarilymonitoring and performing the security design review, architecture review, threat modeling.
• Review and assess the security architecture and design of software applications, infrastructure, and network systems.
• Lead and conduct in-depth reviews of application security architectures, with a focus on cloud-based environments (e.g., AWS, Azure, Google Cloud).
• Identify weaknesses, flaws, and vulnerabilities in the security architecture, considering industry best practices and regulatory requirements.
• Assess the design of cloud services and resources, identifying potential security vulnerabilities and risks.
• Ensure that security controls, encryption methods, and authentication mechanisms are appropriately integrated into the architecture.
• Provide recommendations and guidelines for enhancing the security of the architecture, such as recommending secure design patterns and access control mechanisms.
• Understand application architecture controls & design based on security standards and regulationssuchasNIST,PCI-DSS,ISOetc.
• Well versed with the application deployment and configuration baselines and understanding of howthe application environment operates in a secure environment and how exceptions are handled duringoperations.
• Understand security architecture concepts including topology, protocols, components, and principles toperformthreatmodeling.
• Facilitate use of technology-based tools or methodologies to continuously improve the monitoring,management, andreliabilityoftheservice.
• Be a liaison between the Application development and infrastructure team and integrate theprocesses between infrastructure monitoring and operations processes with the securedevelopment/testingandmanagement processes.
• Identifying, researching, and analyzing application security events which may include emerging andexistingpersistent threatsto theclient'senvironment;and
• Conduct comprehensive threat modeling exercises to identify potential security vulnerabilities and risks within software applications, systems, and networks.
• Collaborate with development teams, architects, and other stakeholders to understand the design and functionality of systems, enabling you to assess potential threats accurately.
• Create threat models and diagrams to document identified security threats and their possible impact on the organization.
• Analyze and prioritize threats based on their potential impact and likelihood, providing actionable recommendations for mitigation.
• Prepare detailed reports and documentation summarizing the results of application security architecture reviews for cloud-based systems.
• Communicate findings and recommendations clearly to technical and non-technical stakeholders.
• Create and maintain security guidelines, policies, and procedures for cloud application security.
  
  

• Approx 5-7 years’ experience in application security testing, deployment, and security management phases
• A strong foundation in security principles and concepts, including confidentiality, integrity, availability, authentication, authorization, encryption, and secure coding practices.
• Proficiency in threat modeling methodologies and tools to identify and assess potential security threats and vulnerabilities in software and systems.
• Deepinterestinapplicationspecificvulnerabilities,infrastructureknowledge.
• Experience in collecting, analyzing, and interpreting qualitative and quantitative data from defined applicationsecurityservicesrelatedsources(tools,monitoringtechniquesetc.)
• In-depth knowledge of security architecture design and best practices, including secure design patterns, access control, and data protection
• Knowledge of cloud security frameworks (e.g., AWS Well-Architected Framework, Azure Security Benchmark) to assess and improve security measures.
• Familiarity with security standards and frameworks, such as OWASP Top Ten, NIST Cybersecurity Framework, ISO 27001, and CIS Controls.
• Ability to conduct risk assessments to evaluate the potential impact and likelihood of security risks and provide risk mitigation strategies.
• Familiarity with security testing tools like vulnerability scanners, penetration testing tools, and code analysis tools.
• Understanding of network and system architecture, protocols, and configurations to assess security at the infrastructure level.
• Understanding of industry-specific regulations, compliance requirements, and security challenges relevant to the organization's sector (e.g., healthcare, finance, or government).
• Awareness of the current threat landscape, emerging security threats, and attack vectors.
• Familiarity with software development methodologies (e.g., Agile, DevOps) to integrate security into the development process.
• Experiencewithperformingapplicationthreatmodelingusingtoolsandmanualtechniques
• Understanding of leading vulnerability scoring standards, such as CVSS, and ability to translate vulnerabilityseverityassecurityrisk.
• Knowledgeofcloudenvironmentsanddeploymentsolutionssuchasserverlesscomputing.
• Possessionofexcellentoralandwrittencommunicationskill.
  
  

• Bachelor’sincomputerscienceorothertechnicalfields;
• Experience in conducting security Architecture reviews and thread modeling on cloud and onprem solutions.
• Understanding of security essentials including networking concepts, defense strategies, and current securitytechnologies
• Ability to research and characterize security threats to include identification and classification of application relatedthreatindicators;
• MusthavecloudsecurityspecializationinSecurity any relevant certifications, such as Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), or Certified Information Systems Auditor (CISA), are a plus
  
  

• Rotational night shifts are a pre-requisite
• The role may require Permanent night shifts basis Client/Project demands
•