Security Lead

App Security Architect

Grade: IS4 | Location: Offshore India | Tower: DCC

Role Summary

Owns the application security architecture and DevSecOps strategy for the SCF platform. Responsible for threat modelling, security baseline definition, SAST/DAST programme governance, and ensuring zero critical vulnerabilities in production-bound releases. Acts as the security authority across all squads, engaged from the Discovery phase through to Extended Build completion.

Key Responsibilities

Produce the security baseline and threat model for the SCF platform during Discovery phase

Define and govern the application security architecture: OAuth2/OIDC, mTLS, RBAC, API security (WAF, rate limiting, schema validation), and secrets management

Own the SAST programme (Snyk/Checkmarx) configure scan policies, triage findings, and enforce remediation SLAs

Own the DAST programme (OWASP ZAP) define scan scope, review results, and track remediation

Define security requirements for all integration touchpoints: Finastra Nexus, KYC/AML adapter, payment hub, ERP connectors

Design SIEM integration hooks define structured security event schema for authentication events, authorisation failures, anomaly detections, and audit log entries

Conduct security design reviews for all 6 core microservices and portal applications

Prepare penetration testing readiness artefacts and coordinate with Finastras security team

Ensure compliance with OWASP Top 10, SANS Top 25, and financial services security standards

Required Skills Experience

8+ years in application/information security with 3+ years in a security architect role

Deep expertise in application security: OAuth2/OIDC, mTLS, JWT, API security, and secrets management

Hands-on experience with SAST tools (Snyk, Checkmarx, or Veracode) and DAST tools (OWASP ZAP, Burp Suite)

Experience designing security architectures for microservices and API-first platforms

Knowledge of SIEM integration patterns and security event schema design

Familiarity with cloud security controls on AWS or Azure (IAM, Security Groups, KMS, GuardDuty)

Understanding of financial services security and compliance requirements (PCI-DSS, ISO 27001, GDPR)

Nice to Have

CISSP, CISM, or CEH certification

Experience with HashiCorp Vault for secrets management

Knowledge of security standards and threat models specific to banking or payments platforms

Experience with penetration testing coordination in financial services environments

Disclaimer: This job description has been sourced from a public domain and may have been modified by Naukri.com to improve clarity for our users. We encourage job seekers to verify all details directly with the employer via their official channels before applying.