Manager - AppSec/DevSecOps Security Engineer

Leadership & Programme Management

• Own and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements.

• Lead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development.

• Act as the primary escalation point for application security risk decisions across engineering and product leadership.

• Drive continuous improvement in AppSec tooling, methodologies, and coverage metrics.

• Represent the AppSec function in client discussions, audits, risk committees, and vendor assessments.

Web Application Penetration Testing

• Oversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios.

• Define and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements.

• Review and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders.

• Drive responsible disclosure and coordinated vulnerability management for critical findings.

Mobile Application Security

• Lead mobile security assessments for Android and iOS—static/dynamic analysis, reverse engineering, and runtime manipulation (Frida, objection, Drozer).

• Establish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams.

• Guide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security.

Source Code Review

• Conduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others).

• Define code review standards and integrate SAST tooling (Semgrep, Checkmarx, Veracode, SonarQube) into development workflows.

• Provide actionable, developer-centric findings with clear severity ratings and remediation guidance.

• Track remediation SLAs and report on code security posture trends over time.

DevSecOps Integration

• Lead integration of security tooling (SAST, DAST, SCA, container scanning, API security) into CI/CD pipelines (Jenkins, GitHub Actions, and similar).

• Define pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left.

• Oversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls.

• Collaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection.

Governance, Risk & Compliance

• Own the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership.

• Ensure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2.

• Define and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates.

• Translate regulatory and client security requirements into testable engineering controls.

AI / GenAI Security

• Assess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows (OWASP LLM Top 10, prompt injection, data leakage).

Incorporate AI security testing into standard AppSec assessment methodologies.

Responsibilities

Leadership & Programme Management

• Own and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements.

• Lead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development.

• Act as the primary escalation point for application security risk decisions across engineering and product leadership.

• Drive continuous improvement in AppSec tooling, methodologies, and coverage metrics.

• Represent the AppSec function in client discussions, audits, risk committees, and vendor assessments.

Web Application Penetration Testing

• Oversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios.

• Define and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements.

• Review and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders.

• Drive responsible disclosure and coordinated vulnerability management for critical findings.

Mobile Application Security

• Lead mobile security assessments for Android and iOS—static/dynamic analysis, reverse engineering, and runtime manipulation (Frida, objection, Drozer).

• Establish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams.

• Guide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security.

Source Code Review

• Conduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others).

• Define code review standards and integrate SAST tooling (Semgrep, Checkmarx, Veracode, SonarQube) into development workflows.

• Provide actionable, developer-centric findings with clear severity ratings and remediation guidance.

• Track remediation SLAs and report on code security posture trends over time.

DevSecOps Integration

• Lead integration of security tooling (SAST, DAST, SCA, container scanning, API security) into CI/CD pipelines (Jenkins, GitHub Actions, and similar).

• Define pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left.

• Oversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls.

• Collaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection.

Governance, Risk & Compliance

• Own the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership.

• Ensure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2.

• Define and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates.

• Translate regulatory and client security requirements into testable engineering controls.

AI / GenAI Security

• Assess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows (OWASP LLM Top 10, prompt injection, data leakage).

Incorporate AI security testing into standard AppSec assessment methodologies.

Qualifications

Skills & Capabilities

Non-Negotiable – Must Have

• 6–8+ years of progressive experience in application security, penetration testing, or a closely related security engineering discipline.

• Expert-level web application penetration testing: complex chained attacks, API abuse, OAuth/OIDC flaws, deserialization, advanced injection techniques.

• Hands-on mobile security testing for Android and iOS (static/dynamic analysis, Frida scripting, MASVS/MSTG alignment).

• Strong source code review skills across at least two major languages—able to identify security defects manually and via SAST tooling.

• Proven experience embedding security into CI/CD pipelines and operating SAST/DAST/SCA tooling in a DevSecOps environment.

• Experience managing or technically leading a team of security engineers or penetration testers.

• Ability to communicate complex security risk credibly to technical and executive audiences.

Good to Have

• Certifications: eWPTX, OSCP, OSWE, BSCP (Burp Suite Certified Practitioner), GWAPT, GWEB, GPEN, CPENT, or equivalent offensive security credentials.

• Cloud security experience across AWS, Azure, or GCP (IAM, network security, SIEM integration).

• Knowledge of AI/GenAI security risks and securing ML pipelines (MLSecOps).

• Threat modelling frameworks: STRIDE, PASTA, attack trees.

• Experience in client-facing security consulting or managed security services.

Leadership & Soft Skills

• Proven ability to build, mentor, and retain high-performing security teams.

• Strong programme management—able to manage concurrent assessments, client deliverables, and operational priorities.

• Influencing skills to drive secure-by-design adoption across engineering organisations without being a pure gatekeeper.

• Commercial awareness: able to balance thoroughness, risk, and delivery timelines.

Qualifications

• Bachelor’s or master’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience.

• 6–8+ years of relevant experience in application security, penetration testing, or DevSecOps with progressive responsibility.

• 1–2+ years in a team lead or management capacity within a security function.

• Offensive security certifications (eWPTX, OSCP, OSWE, or equivalent) strongly preferred.

EXL is the indispensable partner for leading businesses in data-led industries such as insurance, banking and financial services, healthcare, retail and logistics. We bring a unique combination of data, advanced analytics, digital technology and industry expertise to help our clients turn data into insights, streamline operations, improve customer experience, and transform their business. Our partnerships with clients are built on a foundation of collaboration – and we’ve been chosen as a partner by nine of the top ten leading US insurance companies, nine of the top 20 global banks, and six of the top ten US health care payers. We function as one team to make your goals our goals, whether that’s unlocking the value of generative AI or embedding analytics into workflows that reduce risk or power your growth. Clients choose EXL as their transformation partner for many reasons. Our geographic diversity make talent all over the world instantly accessible. Digital accelerators enable unmatched speed-to-value, letting you realize results fast. It’s our people that truly set us apart, though, including the 1,500 data scientists we have dedicated to our generative AI practice. And our more than twenty years of experience in delivering business services, garnering stellar client references, and maintaining a solid balance sheet are reassuring to our C-suite clients. Find out for yourself why clients, employees, and analysts think we’re some of the best in the business. Contact us to see how we can help you achieve your goals.