Requirements
- Having good understanding of NIST security framework / controls.
- Should be able to drive the security architecture level discussion with the product team.
- Understanding webApp and mobile app tiered architecture. (including but not limited to webApp servers, database servers, firewall, VNET (or VPC) concepts.
- Container Security.
- Industry recognized SAST /SCA tools understanding for eg. GHAS.
- Microsoft Azure (from securing various managed/unmanaged services in the cloud). Any certification around Microsoft Azure cloud is preferred.
- Concept of Threat Modelling and what are various vulnerabilities around various interfaces in a typical webApp/enterprise app/cloud infrastructure and mobile app architecture.
- Very good understanding of Owasp Top 10 application security risks.
- Having a CISSP or CISM certification can bring the edge.
- Good verbal and written communication skill (person would be required to educate other functions about the values of cyber security activities).
- Having a good industry experience would be preferred.
