{"id":3046694,"url":"https://alion.io/job/exl-manager-appsecdevsecops-security-engineer","title":"Manager - AppSec/DevSecOps Security Engineer","company":{"id":38016,"name":"EXL","domain":"exlservice.com","url":"https://alion.io/company/exl","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"B","score":80,"open_postings":252,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":15,"computed_at":"2026-10-24T06:02:35Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Noida, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":16500,"max_usd":35000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"C#","optional":false},{"name":"Checkmarx","optional":false},{"name":"CI/CD","optional":false},{"name":"CloudFormation","optional":false},{"name":"Frida","optional":false},{"name":"GitHub Actions","optional":false},{"name":"Go","optional":false},{"name":"ISO 27001","optional":false},{"name":"JavaScript","optional":false},{"name":"Jenkins","optional":false},{"name":"LLM","optional":false},{"name":"NIST 800-53","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Semgrep","optional":false},{"name":"SOC 2","optional":false},{"name":"SonarQube","optional":false},{"name":"Terraform","optional":false},{"name":"TypeScript","optional":false},{"name":"Veracode","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"Burp Suite","optional":true},{"name":"GCP","optional":true},{"name":"IAM","optional":true},{"name":"SIEM","optional":true},{"name":"STRIDE","optional":true}],"status":"live","first_seen_at":"2026-09-02T18:47:36Z","employer_posted_date":"2026-09-02","last_verified_at":"2026-10-24T17:52:36Z","board_verified":true,"closed_at":null,"days_open":52,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":52},"description":"Leadership & Programme Management\nOwn and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements.\nLead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development.\nAct as the primary escalation point for application security risk decisions across engineering and product leadership.\nDrive continuous improvement in AppSec tooling, methodologies, and coverage metrics.\nRepresent the AppSec function in client discussions, audits, risk committees, and vendor assessments.\nWeb Application Penetration Testing\nOversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios.\nDefine and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements.\nReview and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders.\nDrive responsible disclosure and coordinated vulnerability management for critical findings.\nMobile Application Security\nLead mobile security assessments for Android and iOS-static/dynamic analysis, reverse engineering, and runtime manipulation (Frida, objection, Drozer).\nEstablish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams.\nGuide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security.\nSource Code Review\nConduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others).\nDefine code review standards and integrate SAST tooling (Semgrep, Checkmarx, Veracode, SonarQube) into development workflows.\nProvide actionable, developer-centric findings with clear severity ratings and remediation guidance.\nTrack remediation SLAs and report on code security posture trends over time.\nDevSecOps Integration\nLead integration of security tooling (SAST, DAST, SCA, container scanning, API security) into CI/CD pipelines (Jenkins, GitHub Actions, and similar).\nDefine pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left.\nOversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls.\nCollaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection.\nGovernance, Risk & Compliance\nOwn the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership.\nEnsure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2.\nDefine and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates.\nTranslate regulatory and client security requirements into testable engineering controls.\nAI / GenAI Security\nAssess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows (OWASP LLM Top 10, prompt injection, data leakage).\nIncorporate AI security testing into standard AppSec assessment methodologies.\n Leadership & Programme Management\nOwn and evolve the application security strategy, testing roadmap, and service catalogue aligned to business and regulatory requirements.\nLead, and mentor a team of AppSec engineers and penetration testers; manage workload, quality, and career development.\nAct as the primary escalation point for application security risk decisions across engineering and product leadership.\nDrive continuous improvement in AppSec tooling, methodologies, and coverage metrics.\nRepresent the AppSec function in client discussions, audits, risk committees, and vendor assessments.\nWeb Application Penetration Testing\nOversee and conduct advanced web application penetration testing including complex business logic, authentication/authorisation flaws, API abuse, and chained attack scenarios.\nDefine and maintain testing methodology aligned to OWASP Testing Guide, PTES, and client-specific requirements.\nReview and quality-assure penetration test reports produced by the team before delivery to clients or stakeholders.\nDrive responsible disclosure and coordinated vulnerability management for critical findings.\nMobile Application Security\nLead mobile security assessments for Android and iOS-static/dynamic analysis, reverse engineering, and runtime manipulation (Frida, objection, Drozer).\nEstablish and maintain mobile security standards aligned to OWASP MASVS and MSTG across product teams.\nGuide development teams on secure mobile architecture: certificate pinning, secure storage, and inter-process communication security.\nSource Code Review\nConduct and oversee manual source code security reviews across multiple languages (Java, Python, JavaScript/TypeScript, Go, C#, and others).\nDefine code review standards and integrate SAST tooling (Semgrep, Checkmarx, Veracode, SonarQube) into development workflows.\nProvide actionable, developer-centric findings with clear severity ratings and remediation guidance.\nTrack remediation SLAs and report on code security posture trends over time.\nDevSecOps Integration\nLead integration of security tooling (SAST, DAST, SCA, container scanning, API security) into CI/CD pipelines (Jenkins, GitHub Actions, and similar).\nDefine pipeline security gates, policy-as-code standards, and developer feedback loops to shift security left.\nOversee IaC security (Terraform, CloudFormation), secrets management, and supply-chain security controls.\nCollaborate with platform and cloud engineering on secure architecture, baseline hardening, and runtime protection.\nGovernance, Risk & Compliance\nOwn the application security risk register; track, prioritise, and report on vulnerability posture to senior leadership.\nEnsure AppSec activities align with OWASP ASVS, NIST 800-53, ISO 27001, PCI-DSS, and SOC 2.\nDefine and track AppSec KPIs: mean time to remediation, critical findings per release, and coverage rates.\nTranslate regulatory and client security requirements into testable engineering controls.\nAI / GenAI Security\nAssess and mitigate risks in AI/GenAI applications: LLM-based apps, RAG pipelines, agentic workflows (OWASP LLM Top 10, prompt injection, data leakage).\nIncorporate AI security testing into standard AppSec assessment methodologies.\n Skills & Capabilities\nNon-Negotiable - Must Have\n6-8+ years of progressive experience in application security, penetration testing, or a closely related security engineering discipline.\nExpert-level web application penetration testing: complex chained attacks, API abuse, OAuth/OIDC flaws, deserialization, advanced injection techniques.\nHands-on mobile security testing for Android and iOS (static/dynamic analysis, Frida scripting, MASVS/MSTG alignment).\nStrong source code review skills across at least two major languages-able to identify security defects manually and via SAST tooling.\nProven experience embedding security into CI/CD pipelines and operating SAST/DAST/SCA tooling in a DevSecOps environment.\nExperience managing or technically leading a team of security engineers or penetration testers.\nAbility to communicate complex security risk credibly to technical and executive audiences.\nGood to Have\nCertifications: eWPTX, OSCP, OSWE, BSCP (Burp Suite Certified Practitioner), GWAPT, GWEB, GPEN, CPENT, or equivalent offensive security credentials.\nCloud security experience across AWS, Azure, or GCP (IAM, network security, SIEM integration).\nKnowledge of AI/GenAI security risks and securing ML pipelines (MLSecOps).\nThreat modelling frameworks: STRIDE, PASTA, attack trees.\nExperience in client-facing security consulting or managed security services.\nLeadership & Soft Skills\nProven ability to build, mentor, and retain high-performing security teams.\nStrong programme management-able to manage concurrent assessments, client deliverables, and operational priorities.\nInfluencing skills to drive secure-by-design adoption across engineering organisations without being a pure gatekeeper.\nCommercial awareness: able to balance thoroughness, risk, and delivery timelines.\nQualifications\nBachelor’s or master’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience.\n6-8+ years of relevant experience in application security, penetration testing, or DevSecOps with progressive responsibility.\n1-2+ years in a team lead or management capacity within a security function.\nOffensive security certifications (eWPTX, OSCP, OSWE, or equivalent) strongly preferred.","description_format":"text","description_chars":8634,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":2,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","DevSecOps","AI Consulting & Integration","Analytics & BI Consulting"],"lifecycle":[{"event":"open","at":"2026-10-22T00:46:32Z"}],"visa":[],"liveness":{"score":11,"band":"cold","label":"Long shot","p_open":1,"p_active":0.401,"p_room":0.28,"age_days":51,"expected_fill_days":15,"reasons":["conf:2","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-24T06:02:35Z"},"pay":null,"html_url":"https://alion.io/job/exl-manager-appsecdevsecops-security-engineer","json_url":"https://alion.io/job/exl-manager-appsecdevsecops-security-engineer.json","meta":{"generated_at":"2026-10-25T01:15:57Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1958,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":38016},"rest":"https://alion.io/mcp/rest/get_company?id=38016"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fexl-manager-appsecdevsecops-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fexl-manager-appsecdevsecops-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fexl-manager-appsecdevsecops-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/exl-manager-appsecdevsecops-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fexl-manager-appsecdevsecops-security-engineer"}]}