Ramboll

Application Security Specialist

Chennai, India · On-site · Full-time

Apply on the employer’s site ↗See how well you match this job

You apply directly with the employer. ROLIVA does not submit applications from this page and is not the employer.

About the role

Description from the employer’s posting. Check the employer’s page for the current version.

EmployerRamboll
LocationChennai, 600116, India
Work styleOn-site
Employment typeFull-time
Employer posted19 days ago

Application Security Specialist India

Are you motivated by turning complex security and compliance risks into clear, decision‑ready insights? Do you want to work at the intersection of information security, data compliance and governance in a global organisation? Are you looking to make a tangible impact on how a leading consultancy manages cyber and data‑related risks?

If this sounds like you, or you’re curious to learn more, then this role could be the perfect opportunity. Join our Information Security and Data Compliance department

Your new role

The Application Security Specialist operates at the intersection of Information Security and Assurance (ISA) and DevSecOps, ensuring that application security is embedded, measurable, and compliant across Ramboll’s global digital landscape and application development.

This role focuses on integrating security into engineering workflows while aligning with enterprise security frameworks such as ISO 12207 /ISO/IEC 27001 / CIS 18 and industry best practices like OWASP.

Show full description

The Application Security specialist is responsible for identifying, analyzing, and mitigating security vulnerabilities in applications throughout the software development lifecycle (SDLC). This role works closely with development, DevOps, and security teams to ensure secure coding practices and compliance with organizational and industry standards. You will work closely with RAMTECH, data compliance, regulatory and business teams.

Your key responsibilities will be:

Alignment & Assurance

•Translate security policies into actionable technical controls for development teams
•Ensure alignment with:
ISO/IEC 27001
CIS Critical Security Controls
OWASP Top 10
•Support internal/external audits by providing application security evidence andmetrics
•Contribute to risk registers, control effectiveness reviews, and exception handling

DevSecOps Enablement

•Embed application security controls into CI/CD pipelines across business units
•Drive adoption of security-by-design and shift-left security practices
•Integrate and manage tools for:
oSAST, DAST, SCA, Secrets Scanning
•Partner with DevOps teams to standardize secure pipelines globally
Confidential.

Application Risk Management

• Perform risk-based vulnerability assessments and prioritize remediation
• Align risk ratings aligned with Cyber and Information security risk methodology
• Track remediation SLAs and report on risk posture to CISO office.
• Conduct threat modeling for critical applications and digital solutions

Security Testing & Validation

• Oversee and/or perform:
o Secure code reviews
o Penetration testing (manual & automated)
• Validate vulnerability fixes and ensure closure meets compliance requirements
• Establish baseline security requirements for all applications

Developer Security Advisory

• Act as a security champion enabler across distributed engineering teams
• Provide secure coding guidance and conduct targeted training sessions
• Develop reusable secure design patterns and reference architectures.

Metrics, Reporting & Continuous Improvement

• Define and track KPIs such as:
o Vulnerability density
o Mean Time to Remediate (MTTR)
o % of applications onboarded to DevSecOps pipelines
• Build dashboards for leadership visibility and regulatory reporting
• Drive continuous improvement initiatives across global teams

Required Skills & Qualifications
Technical Skills
• Strong understanding of:
o Web technologies (HTTP, REST APIs, microservices)
o Authentication and authorization mechanisms (OAuth, JWT, SSO)
• Knowledge of common vulnerabilities (e.g., SQL Injection, XSS, CSRF)
• Experience with security tools such as:
o SAST: Checkmarx, Fortify
o DAST: Burp Suite, Acunetix
o SCA: Snyk, Black Duck
• Familiarity with programming languages (Java, Python, JavaScript, .NET)

Security Knowledge

• Hands-on experience with OWASP Top 10 risks
• Understanding of threat modeling methodologies
• Experience in bridging policy-to-technical implementation gaps
• Knowledge of cloud security (AWS, Azure, GCP) is a plus

About you

• 5+ years in Application Security, Cyber Security, or Software Development
• Experience working in Agile/DevOps environments
• Prior experience in secure coding or vulnerability management preferred
• Certifications (Preferred)
• Certified Secure Software Lifecycle Professional (CSSLP)
• Offensive Security Certified Professional (OSCP)
• Certified Information Systems Security Professional (CISSP)
• GIAC Web Application Penetration Tester (GWAPT)

Nice to Have

• Experience with bug bounty programs
• Knowledge of container security (Docker, Kubernetes)
• Experience with Infrastructure as Code (IaC) security tools

What we can offer you
• Flexible work environment with the possibility of working from home.
• Commitment to your professional and personal development.
• Leaders guided by Ramboll’s Leadership Principles.
• A culture that welcomes you as the unique person you are.
• The long‑term thinking of a foundation‑owned company.

Ready to join us?
Please submit your application and CV online. We invite diversity in all its forms and encourage applicants from all groups to apply.

See how well you match this job Apply on the employer’s site ↗

Check your resume against this job Free, no sign-up. Nothing you paste is stored.

Staying safe while you apply

Never pay to apply, interview or accept an offer. ROLIVA never asks you for payment to apply to a job.
Apply only through the official “Apply on the employer’s site” button, on the employer’s own site, and check that a recruiter’s email uses that employer’s own domain rather than a free email address.
Be cautious of an offer made with no real interview, or pressure to decide quickly or share financial details early.

Does something look wrong with this listing? Use “Report broken link” in the role details, or read ROLIVA’s full job-safety guidance ↗.

Preparing for this role with ROLIVA

Check the fit.
Compare the requirements with the experience you have confirmed, including gaps.
Prepare honestly.
Build interview stories and application drafts from your own evidence.
Keep track.
Save the role and record your own application status and follow-ups.

Create a free workspace or log in.