Lead Support Analyst

Nomura Overview:

Nomura is a financial services group with an integrated global network. By connecting markets East & West, Nomura services the needs of individuals, institutions, corporates and governments through its four business divisions: Wealth Management, Investment Management, Wholesale (Global Markets and Investment Banking), and Banking. Founded in 1925, the firm is built on a tradition of disciplined entrepreneurship, serving clients with creative solutions and considered thought leadership. For further information about Nomura, visit www.nomura.com.

Nomura Services, India supports the group’s global businesses. With world-class capabilities in trading support, research, information technology, financial control, operations, risk management and legal support, the firm plays a key role in facilitating the group’s global operations across four international regions.

At Nomura, creating an inclusive workplace is a priority. Our approach to inclusion encompasses a variety of initiatives, including sensitization campaigns, implementing conducive policies & programs, providing infrastructure support and engaging in community events. Over time, we have made meaningful progress in these areas, and this commitment has been well-recognized across the industry. We are proud recipients of the prestigious Top 10 Employers award by the India Workplace Equality Index (IWEI), IWEI Gold Employer of Choice awards, India CSR Leadership Award 2024 for Holistic Village Development Program and the YUVA Unstoppable Changemaker Awards.

Divisional Overview:

Powai Information security division is an integral part of Nomura where mostly support functions are delivered out of this entity. We mainly support Nomura wholesale business.

Senior management takes a hands-on approach within the department, and is keen to reward hard work, enthusiasm and success. Nomura presents a unique opportunity to learn and gain experience of a broad range of products and business lines within a supportive setting and surrounded by skilled professionals.

Business Overview:

We are seeking a skilled Automation Engineer to join our Information Security team within the Automation & AI function. This role combines Python development expertise with modern AI application development to drive intelligent automation initiatives across our security operations. The ideal candidate will bring hands-on experience building web applications, APIs, and AI-powered solutions, and security orchestration playbooks while maintaining a solid understanding of cybersecurity principles. You will work at the intersection of security, automation, and AI to transform how our organization approaches information security challenges.

What We Offer:

• We support employee wellbeing by ensuring a sense of purpose and belonging.
• We offer a comprehensive range of wellbeing services which allows employees to get access to the assistance they need at any point in their wellbeing journey.
• Our bespoke benefits support employees and their family’s holistic wellbeing and are inclusive of diverse identities and family structures.

Responsibilities:

• Provide application security architecture support to the teams that build and maintain business systems.
• Manage and maintain a library of application security architecture patterns.
• Conduct comprehensive security architecture assessments for applications, systems, and infrastructure.
• Implement secure-by-design principles in solution architecture and development processes.
• Lead application threat modeling (STRIDE/PASTA) for new features, APIs, and microservices, mapping findings to OWASP Top 10 and OWASP ASVS controls.
• Review application designs and code for authentication, authorization, session management, input validation, output encoding, secrets management, and cryptographic implementation weaknesses.
• Design secure API security patterns (OAuth 2.0, OpenID Connect, JWT handling, rate limiting, schema validation) and validate them against abuse and injection scenarios.
• Review and validate security controls in existing and proposed systems.
• Develop security architecture patterns, standards, and guidelines.
• Create detailed architecture diagrams and documentation using visualization tools.
• Collaborate with security engineering teams to integrate security requirements into the software development lifecycle.
• Perform security risk assessments and threat modeling exercises.
• Ensure compliance with industry standards and regulatory requirements.
• Document security architecture decisions and maintain architecture artifacts.
• Support audit activities and compliance reporting.
• Manage security architecture projects and initiatives using Jira for tracking and workflow management.
• Maintain comprehensive documentation in Confluence including security standards, procedures, and knowledge base articles.
• Create and maintain security architecture repositories and knowledge management systems.
• Work closely with cross-functional teams including DevOps, infrastructure, and application development.
• Provide security guidance and recommendations to stakeholders.
• Participate in architecture review boards and security committees.

Knowledge, Skill, Experience Required:

• Must have 9-10 years of hands-on experience in cybersecurity domain.
• Proven experience in security architecture assessments and secure-by-design implementations.
• Experience with enterprise security frameworks and methodologies.
• Deep understanding of security architecture principles and frameworks
• Proficiency in threat modelling methodologies (STRIDE, PASTA)
• Deep, hands-on knowledge of the OWASP Top 10, OWASP ASVS, and OWASP SAMP/SAMM maturity practices.
• Strong understanding of secure coding practices across common stacks (e.g., Java, .NET, Python, JavaScript/Node.js) and the ability to review code for security defects.
• Expertise in API security, including OAuth 2.0, OpenID Connect, and secure token handling.
• Familiarity with authentication/authorization protocols, secrets management, and cryptographic best practices at the application layer.
• Experience with software supply-chain security, dependency/vulnerability management, and SBOM practices.
• Knowledge of container and cloud-native application security (image scanning, runtime protection, secure configuration).
• Knowledge of security controls and standards (NIST, ISO 27001, CIS Controls)
• Experience with security assessment tools and techniques.
• Understanding of network security, application security, cloud security and data protection domains.
• Expertise in creating detailed architecture diagrams using visualizations, including network diagrams, system architecture, data flow diagrams, and security control mappings
• Strong documentation skills with experience in creating technical specifications, security procedures, and architectural decision records.

Beneficial:

• Strong analytical and problem-solving abilities
• Excellent written and verbal communication skills
• Ability to work independently and manage multiple priorities
• Strong attention to detail and quality-focused approach
• Experience working in agile environments with cross-functional teams

Personal Characteristics:

• Strong analytical and problem-solving abilities.
• Excellent written and verbal communication skills.
• Ability to work independently and manage multiple priorities.
• Strong attention to detail and quality-focused approach.

• Experience working in agile environments with cross-functional teams.

Knowledge, Skill, Experience Required:

Essential:

• Knowledge of regulatory frameworks and experience with regulatory compliance
• Familiarity with security standards (e.g., CRI, ISO 27001, NIST)
• In-depth understanding of information security principles and practices
• Knowledge of current cyber threats and mitigation strategies
• Strong collaboration skills along with the ability to effectively communicate complex security-related information to a business audience, including risk identification, assessment, and remediation activity.
• Excellent communication skills with the ability to articulate complex cyber threat information to technical and non-technical audiences.
• Demonstrable ability to create and maintain collaborative relationships in a large, multinational organization.
• Strong understanding of cyber security principles and technologies.

Beneficial:

• Specialist training or skills in one or more of the following:
• Security certification (CISA/CISM/CISSP/CRISC/ISO-27001 etc.).
• Cloud Security Certifications.

Personal Characteristics:

• Strong communication skills, ability to work comfortably with different regions
• Good team player, ability to work on a local, regional and global basis and as part of joint cross location initiative.
• Strong analytical and problem-solving abilities
• Ability to work independently and as strong team player in global team
• Ability to run with multiple tasks concurrently and manage expectations appropriately.