Summary
Position Summary
ApplicationSecurity—Solution Delivery Advisor
Deloitte’s CyberRiskServices
helpourclientstobesecure,vigilant,andresilientinthefaceofanever-increasing array of cyber threats and vulnerabilities. Our Cyber Risk practice helps organizations with the management of information and technology risks by delivering end-to-end solutions using proven methodologies and tools in a consistent manner.Ourserviceshelporganizationsto address,in atimelymanner,pervasiveissues,suchasidentity theft, data security breaches, data leakage, cyber security, and system outages across organizations of various sizes and industries with the goal of enabling ongoing, secure, and reliable operations across the enterprise.Deloitte’sCyberRiskServiceshavebeenrecognizedasaleaderbyanumberofindependentanalystfirms.
Kennedy Consulting Research & Advisory, a leading analyst firm, recently named Deloitte a global leader in cyber security consulting.
Source: Kennedy Consulting Research & Advisory; Cyber Security Consulting 2013; Kennedy Consulting Research & Advisory estimates © 2013 Kennedy Information, LLC. Reproduced under license.
Workyouwill do
As a Consultant in the hybrid operate business, you are responsible for adhering to the defined operatingproceduresandguidelinesinoperatingthe applicationsecurityservicesintheManagedServicesmodel, which includes the following:
- UnderstandandbecompliantwiththeServiceLevelAgreementsdefinedfortheDevSecOps services;
- Understand and deep knowledge of application security engineering principles, and helping client’s development team and function to follow secure development practices which includes primarily monitoringandperformingthe securitydesignreview,architecturereview,threatmodeling, security testing, secure code review, secure build processes;
- Well versed with the application deployment and configuration baselines, and understanding of how theapplicationenvironmentoperatesinasecureenvironmentandhowexceptionsarehandledduring operations;
- Facilitateuseoftechnology-basedtoolsormethodologiestocontinuouslyimprovethemonitoring, management and reliability of the service;
- Performmanualandautomatedsecurityassessmentofthe applications;
- Involvedintriaginganddefecttrackingprocesswiththedevelopmentteamandhelpingtheteamto fix issues at the code level based on the priority of the tickets;
- BealiaisonbetweentheApplicationdevelopmentandinfrastructureteam,andintegratethe processes between infrastructure monitoring and operations processes with the secure development/testing and management processes;
- Identifying,researchingandanalyzingapplicationsecurityeventswhichmayincludeemergingand existing persistent threats to the client's environment; and
- Performingactivemonitoringandtrackingofapplicationrelatedthreatactorsandtactics,techniques and procedures (TTPs), that could likely cause an impact to client organization
The team
Deloitte’s DevSecOps is a standardized process, to help clients with large development functions, and application dependenciesfortheirday-to-dayoperations.Theprocessenablestheclienttoaddresskeyvulnerabilitiesandrisks associated with their various application environment at different stages of their development lifecycle.At the core of our Application Security Managed Services Team professionals monitors, collects and analyses security related issues on application environment (both at code level and infrastructure level), that may potentially become a threattoanorganization.Thisdetectionofapplicationthreats/vulnerabilitiesiscarriedoutusingauniqueblendofour applicationsecuritytestingandmonitoringtoolsandintelligencedatacollectedthroughourvastexperiencewithinthe Advice and Implement business.
Required:
- Minimumof3-5years’experienceinapplicationsecuritydevelopment,securitytesting,deploymentand security
management phases;
- Deepinterestinapplicationspecificvulnerabilities,codedevelopmentandinfrastructure knowledge;
- Investigativeandanalyticalproblem-solving skills;
- Experienceincollecting,analyzing,andinterpretingqualitativeandquantitativedatafromdefinedapplication security services related sources (tools, monitoring techniques etc.)
- KnowledgeandexperienceofOWASPTop10,SANSSecureProgramming,SecurityEngineering Principles;
- Hands-onexperienceinperformingcodereviewofdotNet,JavaandSwiftand objectiveC code;
- Hands-onexperienceinrunning,installingandmanagingSAST,DAST , SCA andIASTsolutions,suchasCheckmarx, Fortify and Contrast in large enterprise
- Understandingofleadingvulnerabilityscoringstandards,suchasCVSS,andabilitytotranslatevulnerability severity as security risk;
- Hands-onexperienceonatleastoneCI/CDtoolsetandbuildingpipelines usingTeamcity,Bamboo,Jenkins, Chef, Puppet, selenium, AWS and AZURE DevOps;
- HandsonexperienceoncontainertechnologysuchasKubernetes,Dockers,AKS, EKS.
- Knowledgeofcloudenvironmentsanddeploymentsolutionssuchasserverless computing;
- Handsonexperiencein penetrationtestingofmobile,desktopandweb applications;
- Musthaveexperienceinwritingcustomexploitationscriptsand utilities;
- Possessionofexcellentoralandwrittencommunication skill;
- Knowledgeofoneormorescriptinglanguagesforautomationandcomplex searches;
- MusthavecloudsecurityspecializationinSecurity; and
- Certificationsuchas EC-Council CEH (Certified Ethical Hacker), DevSecOps Professional (CDP) , ISC2 Certified Cloud Security Professional (CCSP), Certified API Security Professional (CASP) , CTMP (Certified Threat Modeling Professional) etc.are preferred.
Preferred:
- Bachelor’sincomputerscience orothertechnical fields;
- Experienceincloud service providerssuchasAWS, GCP, Azure, Oracleare preferred
- Experience in implementing and managing security measures within Kubernetes environments, designing and enforcing advanced security protocols for API infrastructure, managing and optimizing our containerized applications using Docker, automating and managing our infrastructure as code using Terraform, automating IT processes and configurations using Ansible, and identifying and mitigating potential security threats through comprehensive threat modeling practices.
- SolidanddemonstrablecomprehensionofInformationSecurityincludingOWASP/SANS,SecurityTestCase development(ormis-usecase).
- Understandingofsecurityessentialsincluding;networkingconcepts,defensestrategies,andcurrentsecurity technologies
- Abilitytoresearchandcharacterizesecuritythreatstoincludeidentificationandclassificationofapplicationrelated threat indicators
Howyouwill Grow
At Deloitte,we have invested a great deal to create arich environment in whichour professionals can grow.We want all ourpeopleto developin theirown way,playingto theirown strengthsastheyhonetheirleadershipskills.And,as a part of our efforts, we provide our professionals with a variety of learning and networking opportunities—including exposuretoleaders,sponsors,coaches,andchallengingassignments—tohelpacceleratetheircareersalongtheway. No two people learn in exactly the same way. So, we provide a range of resources, including live classrooms,team-basedlearning,andeLearning.DeloitteUniversity(DU):TheLeadershipCenterinIndia,ourstate-of-the-art, world-classlearningcenterintheHyderabadoffice,isanextensionoftheDUinWestlake,Texas,andrepresents atangiblesymbolofourcommitmenttoourpeople’sgrowthanddevelopment. ExploreDU:TheLeadershipCenterin India .
Benefits
AtDeloitte,weknowthatgreatpeoplemakeagreatorganization.Wevalueourpeopleandofferemployeesabroad range of benefits. Learn more about what working at Deloitte can mean for you.
Deloitte’s culture
Our positive and supportive culture encourages our people to do their best work every day. We celebrate individuals by recognizing their uniqueness and offering them the flexibility to make daily choices that can help them to be healthy,centered,confident,andaware.Weofferwell-beingprogramsandare continuouslylookingfornewwaysto maintainaculturethatisinclusive,invitesauthenticity,leveragesour diversity,andwhereourpeopleexcelandlead healthy, happy lives. Learn more about Life at Deloitte.
Corporate citizenship
Deloitte is led by a purpose: to make an impact that matters. This purpose defines who we are and extends to relationshipswithourclients,ourpeople,andourcommunities.Webelievethatbusinesshasthepowertoinspireand transform.We focus on education,giving,skill-basedvolunteerism,and leadership to help drive positive social impact in our communities. Learn more about Deloitte’s impact on the world.#CA-LD
Our purpose
Deloitte’s purpose is to make an impact that matters for our people, clients, and communities. At Deloitte, purpose is synonymous with how we work every day. It defines who we are. Our purpose comes through in our work with clients that enables impact and value in their organizations, as well as through our own investments, commitments, and actions across areas that help drive positive outcomes for our communities.
Our people and culture
Our inclusive culture empowers our people to be who they are, contribute their unique perspectives, and make a difference individually and collectively. It enables us to leverage different ideas and perspectives, and bring more creativity and innovation to help solve our clients' most complex challenges. This makes Deloitte one of the most rewarding places to work.
Professional development
At Deloitte, professionals have the opportunity to work with some of the best and discover what works best for them. Here, we prioritize professional growth, offering diverse learning and networking opportunities to help accelerate careers and enhance leadership skills. Our state-of-the-art DU: The Leadership Center in India, located in Hyderabad, represents a tangible symbol of our commitment to the holistic growth and development of our people. Explore DU: The Leadership Center in India .
Benefits To Help You Thrive
At Deloitte, we know that great people make a great organization. Our comprehensive rewards program helps us deliver a distinctly Deloitte experience that helps that empowers our professionals to thrive mentally, physically, and financially—and live their purpose. To support our professionals and their loved ones, we offer a broad range of benefits. Eligibility requirements may be based on role, tenure, type of employment and/ or other criteria. Learn more about what working at Deloitte can mean for you.
Recruiting tips
From developing a stand out resume to putting your best foot forward in the interview, we want you to feel prepared and confident as you explore opportunities at Deloitte. Check out recruiting tips from Deloitte recruiters.Requisition code: 301444
