Skip to content
Talento
Sign inGet started

Talento

Upload your CV, set your preferences, and find jobs that fit.

PrivacyTermsCookiesAccessibility

← All roles

Application Security Lead

at Atkinsrealis

Bangalore, Karnātaka, India, hybrid, full time

seen 5d ago

Apply for this roleSign in to track your application
  • DAST
  • SAST
  • IaC
  • Mobile security testing
  • SBOM
  • Container scanning
  • Penetration testing
  • SCA
  • OWASP SAMM
  • NIST SSDF
  • Docker
  • CI/CD
  • API security testing
  • Secrets scanning
  • IAST
  • Azure DevOps

About the role

On this page

* Overview

* Your role

* About you

* Why choose AtkinsRéalis?

* Rewards & benefits

* Our supportive, collaborative culture inspires us as a global community every day.

* About AtkinsRéalis

More

* Overview

* Your role

* About you

* Why choose AtkinsRéalis?

* Rewards & benefits

* Our supportive, collaborative culture inspires us as a global community every day.

* About AtkinsRéalis

Apply now

Save job

Unsave Job

Bangalore, Karnātaka, India

The Global Application Security & DevSecOps Lead is responsible for, operating and continuously improving the organisation's'application security function across the complete software development lifecycle.

The role owns the policies, technical standards, engineering controls, security testing services, Azure DevOps integrations, application security platforms and governance processes required to ensure that internally developed and externally supplied applications are designed, built, tested and released securely.

This is both a leadership and hands‑on engineering role. The role holder must be capable of defining the global AppSec strategy while also configuring, integrating, operating, troubleshooting and improving the underlying security tools.

The role will embed automated and risk‑based security controls into Azure DevOps repositories and CI/CD pipelines at enterprise scale, covering potentially hundreds of Azure DevOps projects and thousands of repositories.

The role is accountable for ensuring that security controls are:

* Technically effective. * Integrated into engineering workflows. * Proportionate to application risk. * Reliable enough to support mandatory release gates. * Properly tuned to minimise false positives. * Measurable and auditable. * Supported by clear operating procedures. * Adopted consistently across global development teams.

Read from careers.atkinsrealis.com, last seen 2d ago.

What you would do

AppSec strategy and operating model

The role holder will:

* Maintain the global Application Security and DevSecOps strategy. * Establish the AppSec function's mandate, service catalogue, governance model and engagement process. * Define the division of responsibilities between AppSec, engineering, cloud security, architecture, SOC, vulnerability management, risk and compliance. * Develop a risk‑based AppSec control framework for different application types and criticality levels. * Establish minimum security requirements for internally developed, externally developed and SaaS applications.

Define application risk tiers based on factors such as:

* Data classification. * Internet exposure. * Transaction value. * Regulatory impact. * Privileged access. * Customer impact. * Business criticality. * Safety impact. * Use of AI or autonomous functionality.

* Maintain an AppSec roadmap covering people, process, technology and maturity. * Undertake periodic maturity assessments against NIST SSDF and OWASP SAMM. * Develop annual investment, licensing and resource plans. * Own the AppSec tooling budget and supplier roadmap. * Produce executive‑level risk reporting for the CISO and technology leadership. * Represent Application Security at architecture, engineering and risk governance forums.

AppSec service catalogue

Establish and operate defined services covering:

* Secure code review. * SAST onboarding. * SCA onboarding. * DAST onboarding. * API security testing. * Mobile security testing. * Pipeline security assessment. * Secure Azure DevOps configuration. * Secrets scanning. * IaC and container scanning. * Penetration‑test scoping and coordination. * AppSec exception assessment. * Secure release assurance. * Developer security training. * Security Champions support. * Supplier application security review. * Application incident root‑cause analysis.

Secure SDLC governance

The role holder will:

* Define mandatory security activities for each SDLC stage. * Establish security acceptance criteria for epics, features and user stories. * Define mandatory evidence required for production release. * Develop risk‑based security release gates. * Ensure emergency‑release procedures include proportionate security checks and retrospective review. * Define criteria for when applications require manual review or penetration testing. * Integrate AppSec activities with enterprise architecture and change‑management processes.

Engineering

What they are looking for

The role owns or governs the following application security capabilities:

* Secure software development lifecycle governance. * Secure coding standards. * Static application security testing. * Software composition analysis. * Dynamic application security testing. * Interactive application security testing, * Manual secure code review. * Application penetration testing. * API security testing. * Cloud‑native and serverless application security. * Container and application image security during build. * Infrastructure‑as‑code security within application delivery pipelines. * Secrets detection and prevention. * Software supply‑chain security. * SBOM generation and governance. * Build provenance, artifact integrity and signing. * Azure DevOps repository and pipeline security. * Application security tool ownership and operation. * Security Champions and developer enablement. * Application security exception and risk‑acceptance processes. * Application security metrics, reporting and assurance. * Third‑party and externally developed software assurance. * Security of AI‑enabled applications and AI‑generated code. * Product security incident support and root‑cause analysis.

Explicit scope boundary: not enterprise vulnerability management

* Operating‑system vulnerability scanning. * General infrastructure vulnerability scanning. * Network‑device vulnerability management. * Endpoint vulnerability management. * Firmware vulnerability management. * Enterprise patch management. * Cloud‑host vulnerability remediation. * Runtime host and virtual‑machine vulnerability management. * General CSPM remediation ownership. * SOC monitoring and incident queue management. * Enterprise‑wide CVE reporting unrelated to applications. * Infrastructure penetration testing.

The AppSec function nevertheless owns the management of security defects, including:

* Validation and triage of AppSec findings. * Removal of false positives and duplicate findings. * Assignment of findings to the correct engineering teams. * Definition of application‑security remediation requirements. * Verification that fixes are effective. * Management of AppSec‑specific exceptions. * Reporting on application‑security exposure. * Escalation of overdue high‑risk application findings.

For containers, the function owns build‑time image and Dockerfile security. Runtime host, node and deployed‑container vulnerability management should remain with Cloud Security, Platform Security or Vulnerability Management, subject to a defined RACI.

Why choose AtkinsRéalis?

Wherever you are in your career – and whoever you are – AtkinsRéalis is for you. Here, support and collaboration are a vibrant part of a culture that lets you choose where – and how far – your career can go. Take on projects that push boundaries and drive sustainable impact, surrounded by colleagues who believe there's no limit to how brilliant you can be. It's time to join a like‑minded team where you'll be rewarded, supported, and free to be your kind of brilliant.

Bangalore, Karnātaka, India

Save job

Unsave Job

saved

viewed

Associate Technical Director

Engineering Full time

Associate Technical Director

Various locations

Save job

Unsave Job

saved

viewed

Related blogs

Engineering

Metallurgy and corrosion: Jean‑François

Jean‑François is director of the metallurgy and corrosion group at AtkinsRéalis. With several decades of experience in materials science, welding inspection, corrosion, and quality control, he helps ensure the safety, durability, and reliability of critical infrastructure across Canada.

Card link for Metallurgy and corrosion: Jean‑François

Architecture & Planning

From Design Manager to digital innovator: Building meaningful impact at Atkinsréalis

From design management to digital innovation, discover how Mohana turned a new passion for BIM into a career shaped by creativity, collaboration, and impact.

Card link for From Design Manager to digital innovator: Building meaningful impact at Atkinsréalis

Engineering Structural

Building more than projects: Ragavendran’s journey of growth

Some projects test your technical skills. Others change how you see your career. For Ragavendran, both happened along the way.

Card link for Building more than projects: Ragavendran’s journey of growth

Engineering

Alexandre, mechanical engineer at AtkinsRéalis: leading industrial lifting projects in Saguenay

When I chose to join AtkinsRéalis in Canada, I wanted to explore a new side of engineering. After working for contractors and equipment manufacturers as an estimator, project manager, and design engineer, this was my first experience with an engineering consulting firm. Today, I can confidently say that this decision has allowed me to broaden my skills while contributing to major industrial projects across the Saguenay‑Lac‑Saint‑Jean region of Quebec.

Card link for Alexandre, mechanical engineer at AtkinsRéalis: leading industrial lifting projects in Saguenay

Engineering Civil

Beyond the design: Praveen’s journey from delivery to ownership at AtkinsRéalis

Praveen has grown by taking on new challenges, broadening his perspective, and turning experience into greater ownership.

Card link for Beyond the design: Praveen’s journey from delivery to ownership at AtkinsRéalis

Engineering Electrical

Designing with purpose, leading with confidence: Lekhana’s journey at AtkinsRéalis

From solving complex engineering challenges to leading teams, Lekhana’s journey shows how the right opportunities can transform not just what you do, but who you become.

Card link for Designing with purpose, leading with confidence: Lekhana’s journey at AtkinsRéalis

Human Resources

From humble beginnings to HR leadership: Rajesh's journey at AtkinsRéalis.

Rajesh's story shows how resilience, curiosity, and the right opportunities can shape an extraordinary career.

Card link for From humble beginnings to HR leadership: Rajesh's journey at AtkinsRéalis.

Nuclear Project & Programme Management

How saying yes opened new doors for Bharathi: A career move that changed everything.

Sometimes the best career moves are the ones you never planned. Discover Bharathi's story.

Card link for How saying yes opened new doors for Bharathi: A career move that changed everything.

Engineering Water

Creating impact through engineering excellence

What keeps an engineer inspired after nearly a decade in the industry? Devendra shares his journey.

Card link for Creating impact through engineering excellence

Project & Programme Management

15 years at AtkinsRéalis: A journey defined by growth, people, and purpose.

Fifteen years. Countless opportunities. One remarkable career journey.

Card link for 15 years at AtkinsRéalis: A journey defined by growth, people, and purpose.

Water

Four decades in, still growing: How Jagannath is shaping the future of Water at AtkinsRéalis.

After nearly 40 years in the water industry, Jagannath proves that growth doesn't stop with experience, it evolves with it.

Card link for Four decades in, still growing: How Jagannath is shaping the future of Water at AtkinsRéalis.

Engineering Transportation

From engineer to project leader: Serafina on aviation, mentorship, and growth in Florida

Meet Serafina from our Tampa office, where she's helping airports grow and communities thrive.

Card link for From engineer to project leader: Serafina on aviation, mentorship, and growth in Florida

Back to top

What comes with it

-

Apply now

Sign up for job alerts

Share

Save job

Unsave Job

Explore the rewards and benefits that help you thrive – at every stage of your life and your career.

This includes

* Comprehensive life insurance coverage. * Premium medical insurance for you and your dependents. * Generous annual leave balance. * Flexible and hybrid work solutions. * Remote work opportunities outside of country. * Company gratuity scheme. * Discretionary bonus program. * Relocation assistance. * Employee Wellbeing Program: 24/7 access to specialists in finance, legal matters, family care, personal health, fitness, and nutrition.

Seize every opportunity to sharpen your skills, expand your expertise, and be recognized for the impact you make.

Make it brilliant, a career with AtkinsRéalis

Our supportive, collaborative culture inspires us as a global community every day.

Watch this short film and imagine what you could achieve here, too.