Senior Cybersecurity Lead - DevSecOps, Governance

Senior Cybersecurity Lead to own security process and governance across the SDLC for engineering teams in Chennai and the US. Working with the Principal Security Engineer, you will define and maintain the security processes and controls our engineering teams follow across our cloud platforms. You will embed Secure SDLC/DevSecOps, run penetration testing and vulnerability management, partner with the AI team to secure and govern AI-enabled capabilities, and lead security culture, audit readiness, and incident management. You will also report security risk to engineering and business leaders. 

What You'll Do 

You'll own the process and governance for cybersecurity within the SDLC, focused on three core priorities: 

• Embedding security into the SDLC. Partner with the Engineering team on design reviews, CI/CD testing, penetration testing, and vulnerability management. 
• Securing and governing AI. Partner with the AI team to set the security and governance guardrails for AI/LLM-enabled features and AI-assisted development in Platform Services. 
• Driving security culture and governance. Make security part of the definition of done for engineering and AI teams in Chennai and the US; lead ISO 27001 / SOC 2 audit readiness; work with the Principal Security Engineer on incident management. 

Embed security into the SDLC 

• Define and maintain Secure SDLC / DevSecOps processes, security controls, and review gates with engineering across internal and cloud-based apps.
• Integrate security testing and automation into CI/CD with Engineering and DevOps; define testing requirements and roll out secure-coding practices and tooling. 
• Ensure architecture/design reviews and threat modelling happen early in delivery; work with the Principal Security Engineer to address identified risks. 
• Institute cloud security review processes for AWS and/or Azure: ensure IAM, network, logging, encryption, and CI/CD security are reviewed with the relevant technical teams. 
• Own the penetration testing process for web, API, cloud, and infrastructure: coordinate scoping, testing, reporting, remediation tracking, and retesting. 
• Run the vulnerability management process with risk-based prioritization (exploitability, exposure, impact, asset criticality); coordinate remediation with engineering and track findings to closure. 

Secure and govern AI 

In partnership with the AI team: 

• Set AI security policy and minimum controls for AI-enabled products and AI-assisted development (least privilege, tool allowlists, data-loss controls, input/output validation). 
• Identify and track AI risks: data and code leakage, prompt injection, unsafe output, over-permissioned agents, model/supply-chain, and IP/licensing. 
• Define oversight standards for AI agents: autonomy limits, when human approval is required, auditability, and AI incident escalation. 
• Align with ISO/IEC 42001 and NIST AI RMF; provide evidence for audits and customer assurance. 

Drive security culture and governance 

• Run security awareness and secure-coding training for engineering teams in Chennai and the US. 
• Mentor engineers on secure practices; coordinate with Engineering, AI, DevOps, Architecture, and Product on adoption. 
• Support ISO 27001 / SOC 2 controls and audits; use security metrics and reporting to track adoption and improve processes. 
• Partner with the Principal Security Engineer on security incident management: defining escalation paths, coordinating response, and leading post-incident reviews. 

Must Have Experience

• 8–10+ years in cybersecurity, with a strong application security background. 
• Solid understanding of web and API security (OWASP Top 10, OWASP API Security Top 10). 
• Led penetration testing and vulnerability management programs end-to-end: scoping, risk-based prioritization, remediation tracking, and retesting. 
• Built or matured Secure SDLC / DevSecOps processes, including SAST, SCA, DAST, secrets scanning, and review/merge gates in CI/CD. 
• Experience running or participating in threat modelling as part of delivery. 
• Familiarity with software supply-chain security (SBOM, build integrity). 
• AWS and/or Azure security, including IAM, network, logging, encryption, and cloud security controls and review processes. 
• Strong understanding of incident response and incident management. 
• Experience with managed security services and security operations. 
• Working knowledge of security governance and compliance frameworks (ISO 27001, SOC 2), including control design, audit evidence, and security metrics. 
• Working knowledge of AI/LLM security risks (e.g., prompt injection, data leakage, over-permissioned agents) and the OWASP LLM Top 10. 
• Strong communication, stakeholder management, and leadership; proven ability to get security practices adopted across teams without direct authority. 

Preferred

• SaaS, product, or cloud-based environment experience; security automation. 
• Experience securing AI/LLM-enabled applications or establishing AI governance (e.g., ISO/IEC 42001, NIST AI RMF). 
• Established a threat modelling practice across teams: standard methodology (e.g., STRIDE), templates, and review cadence. 
• Implemented software supply-chain controls: SBOM management, artifact signing, and provenance (e.g., SLSA). 
• Managed MSSP/MDR relationships: SLAs, escalation, and integration with internal incident processes. 
• Certifications: CISSP, CISM, or CRISC; ISO 27001 Lead Implementer/Auditor a plus. 

Education

Bachelor's or Master's in Computer Science, Cybersecurity, IT, Engineering, or related – or equivalent experience plus recognized certifications.

Security and compliance with statutory requirements in the countries in which we operate is essential for DNV. Background checks will be conducted on all final candidates as part of the offer process, in accordance with applicable country-specific laws and practices.

• Flexible work arrangements for better work-life balance
• Generous Paid Leaves (Annual, Sick, Compassionate, Local Public, Marriage, Maternity, Paternity, Medical leave)
• Medical benefits ( Insurance and Annual Health Check-up)
• Pension and Insurance Policies (Group Term Life Insurance, Group Personal Accident Insurance, Travel Insurance)
• Training and Development Assistance (Training Sponsorship, On-The-Job Training, Training Programme)
• Additional Benefits (Long Service Awards, Mobile Phone Reimbursement)
• Company bonus/Profit share.

*Benefits may vary based on position, tenure/contract/grade level*