Application Security Consultant

Job Summary

As a global leader in assurance, tax, transaction and advisory services, we hire and develop the most passionate people in their field to help build a better working world. This starts with a culture that believes in giving you the training, opportunities and creative freedom. At EY, we don't just focus on who you are now, but who you can become. We believe that its your career and Its yours to build which means potential here is limitless and we'll provide you with motivating and fulfilling experiences throughout your career to help you on the path to becoming your best professional self.

Role Overview

As discussed today, we have requirement for one of our client, for Pune locaon on Appsec Secrets Management professional.

Experience: 45 years of experience in Applicaon Security, SSDLC, Governance, or similar roles.

Qualifications

• Bachelor's Degree in IT, Engineering, or a related eld.

Must-Have Skills

• Strong understanding of secrets exposure risks (API keys, tokens, passwords, cer tates).
• Experience reviewing secrets scanning outputs and validing remediaon acons.
• Working knowledge of SAST concepts and governance work ows.
• Familiarity with GitHub and CI/CD environments.
• Strong documentaon, coordinaon, and communicaon skills.

Nice-to-Have Skills

• Exposure to Checkmarx tools.
• Familiarity with enterprise tracking tools (e.g., ServiceNow).
• Familiarity with Security Governance.

Responsibilities

• Govern and track Secrets ndings across repositories, ensuring remediaon within de ned SLAs.
• Coordinate with development, plaorm, risk, and compliance teams on remediaon, excepons, deferrals, and risk acceptances.
• Maintain governance artefacts, audit-ready documentaon, metrics, dashboards, and execuve reporng.
• Monitor remediaon progress, idenfy overdue items, and drive stakeholder escalaons as required.
• Act as the primary point of contact for developer and stakeholder queries, providing guidance on ndings, remediaon, and governance processes.
• Analyze ndings from approved security tools, validate closure evidence, review false posives, and support process improvements.
• Deliver weekly/monthly governance reports covering remediaon trends, ageing ndings, excepons, and overall risk posture.
• Work on netuning the secret scanning rule sets for reducing noise due to false posives

What we look for

People with the ability to work in a collaborative manner to provide services across multiple client departments while following the commercial and legal requirements. You will need a practical approach to solving issues and complex problems with the ability to deliver insightful and practical solutions. We look for people who are agile, curious, mindful, and able to sustain positive energy, while being adaptable and creative in their approach.