Technical Lead

Technical Lead – Application Security Location: Mumbai, India (Onsite)Experience Required: 20+ years (Application security + AI/ML security)Compensation: As per industry benchmarksEmployment Type: Full-Time | PermanentRole OverviewWe are hiring a Techno Managerial Lead – Application Security to join our CISO team inMumbai. This is a critical, hands-on leadership role that blends strategic oversight with deeptechnical expertise in application security. The ideal candidate will spearhead security testingof applications, evangelize secure software development practices, lead secure code reviews,and collaborate across teams to embed security into the software development lifecycle (SDLC).Key Responsibilities• Strategic Leadership:✓ Define and evolve the bank’s application security strategy and roadmap includingAI/ML and LLM security testing.✓ Align security initiatives with business goals and regulatory requirements.• Technical Execution:✓ Lead secure SDLC integration across development teams(including DevSecOps) ofsecurity testing tools.✓ Oversee application security tools & processes for SAST, SCA DAST, Code Reviewacross diverse technologies such as Web, Mobile, API etc.✓ Participate and provide expert opinion in secure architecture design reviews forcritical applications.✓ Ensure periodic refresh of test cases catalogue against bank specific use-cases,emerging threats & global frameworks.✓ Define, publish, and govern policies, secure coding standards, and open-source usageguidelines.✓ Leverage AI security tools for scanning, fuzzing, and penetration testing of AI models.✓ Apply best practices from OWASP Top 10 for ML/LLMs, MITRE ATLAS, NIST AI RMF,and ISO/IEC 42001 to test AI/ML assets.✓ Stay informed about emerging threats and security trends in AI/ML technologies, andprovide recommendations for enhancing security posture.✓ Ensure AI model security testing framework aligns with internal policy, nationalregulatory requirements, and global best practices.Classification - InternalClassification - Internal✓ Plan and execute security tests for AI/LLM systems, including jailbreaking, RAGhardening,• Program Management:✓ Build and lead a high-performing AppSec team for pre-golive security testing as well aspost-go live testing of scoped applications through structured calendar program.✓ Develop and track KPIs and metrics to measure program effectiveness.✓ Manage vendor relationships and maintain centralized governance across applicationsecurity, source code review, open source, and AI Security programs.✓ Drive compliance with internal and regulatory requirements through periodic securitytesting and reporting.• Stakeholder Engagement:✓ Collaborate with engineering, risk, development, DevOps, risk, and compliance teams.✓ Provide executive-level reporting and risk insights.✓ Build and expand a security-first development culture through continuous securecoding training, workshops, and security champion’s programme to promote securityawareness and advocacy within development teamsRequired Skills & Experience• 20 years of experience in cybersecurity, with at least 15 years in application securityprogram management, development & testing (SAST/DAST/SCA) and minimum 5 years inleadership roles.• Proven track record of managing large-scale AppSec programs in BFSI or regulatedenvironments.• Experience in dealing with regulatory bodies and response.• Hands-on experience with secure coding, manual application penetration testing, andDevSecOps practices.• Experience working with cloud-native applications and microservices architectures.• Deep understanding of OWASP Top 10 for Web, Mobile and API and their correspondingOWASP Testing guides, CWE and OWASP developer guide and other secure codingstandards.• Proficiency in security tools: Fortify, Checkmarx, Veracode, MobSF, Frida, XposedFramework, Cydia, JDgui, Burp Suite, etc.• Strong programming background (Java, .NET, Python, etc.) would be an added advantage.• Familiarity with CI/CD pipelines and integrating security into DevOps.• Hands-on experience with AI/ML security or secure MLOps/LLMOps• Proficient in Python, TensorFlow/PyTorch, HuggingFace, LangChain, and common datascience libraries• Strong understanding of AI-specific threat models (MITRE ATLAS) and securitybenchmarks (OWASP Top 10 for ML/LLMs)• Excellent communication, leadership, and stakeholder management skills.• Ability to translate technical risks into business impact clearly to non-technicalstakeholdersClassification - InternalClassification - InternalQualifications and Certifications• Bachelor’s or Master’s degree in Computer Science, Information Security, or related field.• Certifications: CISA, CISM, CISSP, CSSLP, OSCP, OSWA, OSWE, SANS WAPT SEC542, CloudSecurity, ML Security, or relevant AI/ML certificates• Why Join Us?✓ Work on mission-critical security initiatives in a high-impact role.✓ Be part of a forward-thinking cybersecurity team in a leading financial institution.✓ Opportunity to shape the future of secure banking applications.