Morningstar

Lead Security Analyst

India · Work style not stated · Full time

Posted over 6 months ago: check it’s still open

Apply on the employer’s site ↗See how well you match this job

You apply directly with the employer. ROLIVA does not submit applications from this page and is not the employer.

About the role

Description from the employer’s posting. Check the employer’s page for the current version.

EmployerMorningstar
LocationIndia
Work styleWork style not stated
Employment typeFull time
Employer posted9 Oct 2025

The Area: The Information Security department is responsible for setting enterprise security policies and standards that are designed to protect the confidentiality, integrity and availability of Morningstar information. The security team offers guidance and technical expertise in areas like application security, policies and procedures, disaster recovery and compliance/regulation. We analyze emerging security threats and conduct risk and vulnerability assessments to ensure that our information remains secure.

The Role: The Lead Security Analyst will assist in supporting Morningstar’s application security automation program. This individual will help integrate static and dynamic security analysis tools into Morningstar’s continuous integration processes, assist with security remediation activities, ensure that vulnerabilities are being remediated in a timely manner and support development and technical personnel as required. This position is based in our Mumbai location.

Show full description

Responsibilities
+ Create, manage and maintain Jenkins continuous integration jobs to support application security automation
+ Administer common static and dynamic security assessment tools
+ Verify automated application security findings that result from automated static and dynamic assessments
+ Work directly with internal business units to communicate risks and to help ensure open vulnerabilities are resolved in a timely manner
+ Collect and analyze application security metrics
+ Provide security remediation advice and training to technical personnel
+ Assist with documenting secure coding guidelines and running training programs to assist internal development personnel
+ Provide software security support and remediation guidance to development personnel

Requirements
+ A bachelor’s degree and 7+ years’ experience in a development or software security / penetration testing role
+ We’re looking for someone who enjoys breaking code, solving puzzles, and diagnosing problems
+ Excellent communication skills and a strong understanding of software development and application security fundamentals
+ Candidates should be interested in keeping up with the latest security trends, as well as enjoy performing code / architecture reviews and penetration test activities
+ Experience with common static and dynamic analysis tools (Semgrep, Brightsec, WAF etc.)
+ A strong understanding of security best practices in Java, JavaScript, .NET, PHP and Ruby programming languages
+ Strong understanding of common authentication models (SAML, OAuth, OpenID, etc.) is preferred
+ A software development and application security background is preferred

Morningstar is an equal opportunity employer.

Morningstar's hybrid work environment gives you the opportunity to collaborate in-person each week as we've found that we're at our best when we're purposely together on a regular basis. In most of our locations, our hybrid work model is four days in-office each week. A range of other benefits are also available to enhance flexibility as needs change. No matter where you are, you'll have tools and resources to engage meaningfully with your global colleagues.

I10_MstarIndiaPvtLtd Morningstar India Private Ltd. (Delhi) Legal Entity

See how well you match this job Apply on the employer’s site ↗

Check your resume against this job Free, no sign-up. Nothing you paste is stored.

Staying safe while you apply

Never pay to apply, interview or accept an offer. ROLIVA never asks you for payment to apply to a job.
Apply only through the official “Apply on the employer’s site” button, on the employer’s own site, and check that a recruiter’s email uses that employer’s own domain rather than a free email address.
Be cautious of an offer made with no real interview, or pressure to decide quickly or share financial details early.

Does something look wrong with this listing? Use “Report broken link” in the role details, or read ROLIVA’s full job-safety guidance ↗.

Preparing for this role with ROLIVA

Check the fit.
Compare the requirements with the experience you have confirmed, including gaps.
Prepare honestly.
Build interview stories and application drafts from your own evidence.
Keep track.
Save the role and record your own application status and follow-ups.

Create a free workspace or log in.