Overview

Join EY as a Manager – Application Security & DevSecOps to lead and drive Secure SDLC practices across the software development lifecycle. You will define security standards and processes, guide security practices in CI/CD pipelines, perform security assessments, and provide insights for risk mitigation in enterprise environments.

Responsibilities

• Lead application security consulting engagements working closely with clients to define, design, and implement scalable AppSec and DevSecOps programs aligned to business objectives
• Manage and oversee large-scale, enterprise applications ensuring security is embedded across the SDLC
• Drive end-to-end application security program development including governance tooling strategy operating model, and maturity roadmap
• Perform current-state DevSecOps and AppSec maturity assessments (OWASP SAMM, NIST SSDF, BSIMM), identify gaps, and provide actionable recommendations to clients
• Architect and implement DevSecOps programs integrating security controls into CI/CD pipelines (SAST, SCA, DAST, secrets scanning, IaC, container security)
• Provide technical leadership and team management guiding and mentoring junior consultants reviewing deliverables, and ensuring quality outcomes
• Engage directly with client stakeholders (technical and executive), communicating risks strategies, and security posture improvements effectively
• Translate complex security concepts into business-aligned insights for senior leadership and non-technical stakeholders
• Lead secure SDLC enablement including secure coding practices, source code reviews, and vulnerability remediation guidance
• Design and implement automation strategies for security tools (SAST/DAST reporting, pipeline integrations, dashboards)
• Drive adoption of agile and lean product development principles embedding security into iterative development cycles
• Define and implement AppSec governance frameworks policies, standards, and metrics for continuous improvement
• Support business development activities
• Develop custom security solutions and accelerators to proactively mitigate risks across the organization
• Integrate AI/ML capabilities into application security programs including risk prioritization, anomaly detection, and intelligent vulnerability management
• Lead initiatives around AI security and secure adoption of GenAI/LLMs including threat modeling, prompt security, and secure integration into enterprise environments

Qualifications

• Proven experience in application security consulting and advisory, including client-facing program delivery
• Experience with scripting / programming skills (e.g., Python, PowerShell, Java, Perl etc.) updated and familiarized with the latest exploits and security trends
• Strong expertise in building and scaling AppSec/DevSecOps programs in enterprise environments
• Hands-on experience with manual and automated Threat modeling, SAST, DAST, and SCA assessments
• Strong team management and leadership skills, with experience mentoring and managing distributed teams
• Excellent client communication and stakeholder management skills, including interaction with senior leadership
• Experience in designing and implementing DevSecOps CI/CD pipelines using both open-source and enterprise tools
• Proficiency in scripting/programming (Python, PowerShell, Java, etc.) with awareness of latest exploits and security trends
• Familiarity with DAST tools (Acunetix, WebInspect, AppScan, Burp Suite), SAST,SCA tools (Checkmarx, Fortify, Veracode, Coverity), container and cloud security tools
• Experience in performing Threat modeling using STRIDE methodologies
• Experience integrating security into SCM platforms (GitHub, GitLab, Bitbucket) using webhooks, actions, and pipeline controls
• Strong knowledge of web application security (OWASP Top 10) and secure coding practices
• Experience across container security, IaC security, and compliance-as-code implementations
• Ability to optimize DevSecOps pipelines and define security maturity models and KPIs
• Strong understanding of Agile, DevOps, and Lean development practices
• Exposure to AI/ML and GenAI technologies, including their usage in secure SDLC, automation, and developer productivity
• Understanding of AI/ML security risks (model poisoning, prompt injection, data leakage) and mitigation techniques
• Experience or familiarity with AI-assisted security tools (e.g., AI-driven code analysis, automated triaging, LLM-based secure coding support)
• BE/B.Tech/MCA degree required
• Minimum of 10 years of work experience in application security, Secure SDLC and DevSecOps
• Certifications: Azure Security Architect (Az-500), AWS security speciality certification (SCS-C01) or equivalent
• Knowledge of Windows, Linux, UNIX, any other major operating systems
• Strong Excel and PowerPoint skills
• Project management skills preferred

Nice to have

• Certifications: CSSLP, CISSP, Certified DevSecOps Professional
• Experience working with AI/ML and GenAI-related security tools and frameworks
• Advanced knowledge in threat modeling and secure code review techniques
• Proven track record leading teams and delivering projects at enterprise scale

Education

• Bachelor's or Master’s degree in Computer Science, Information Technology, Engineering, or related field required

Benefits

• Opportunity to be part of a global team working on impactful technology projects
• Career growth within a rapidly expanding international organization
• Engagement with diverse, mission-driven stakeholders across Europe
• Development of cutting-edge security practices in modern software delivery pipelines
• Access to continuous learning and certification support
• Supportive culture that values diversity and innovation