USI FY27 | Cyber Operate- SAST/DAST - L35

We are seeking a Consultant– AI/ML/DevSecOps / Application Security with strong hands-on delivery experience in SAST, SCA, and DAST to embed security across the software development lifecycle. This role focuses on implementing and operating application security tooling in CI/CD pipelines, executing application security assessments (including API security), triaging and prioritizing findings, enabling remediation, and driving secure-by-design engineering practices across cloud-native and enterprise applications. SAST, SCA, and DAST remain foundational AppSec capabilities, and the role is positioned accordingly with an emphasis on measurable delivery outcomes (tool onboarding, pipeline coverage, risk reduction, and remediation closure).
Work you'll do
As a Consultant on the Cyber Operate team, you will be responsible for…
Integrate, configure, and optimize static application security testing (SAST), software composition analysis (SCA), and dynamic application security testing (DAST) tools in continuous integration and continuous delivery (CI/CD) pipelines, including quality gates and exception workflows.
Perform security assessments across application code, open-source dependencies, REST and GraphQL application programming interfaces (APIs), cloud-native workloads, containers, and Kubernetes environments to identify vulnerabilities, exposed secrets, configuration gaps, and software supply-chain risks.
Triage scan results, validate findings, prioritize vulnerabilities based on exploitability and business impact, and provide remediation guidance, compensating controls, and verification steps.
Facilitate threat modeling and security design reviews; translate risks into secure design requirements, test cases, acceptance criteria, and engineering backlog items.
Implement DevSecOps controls, including infrastructure-as-code scanning, secrets detection, container image scanning, policy-as-code, software bills of materials, and build and release integrity controls.
Design and build artificial intelligence agents and agentic workflows for application security automation; assess AI/ML and generative AI application risks; and deliver client reports, dashboards, trend analysis, and implementation roadmaps.
The team
Deloitte's Cyber Operate teams manage clients' critical cyber assets either as a fully managed service or in partnership with clients. They deliver skilled talent, cutting-edge technologies, and robust processes to operate client cyber capabilities. This includes:
Managing Identity Lifecycle
Security Operations
Threat Intelligence
Application Security
Business Transformation
Continuous Compliance
Location: Bangalore, Hyderabad, Pune, Chennai, Kolkata
Shift Timings: Rotational
Qualifications
Required:
Bachelor’s degree or higher in Computer Science, Engineering, Cybersecurity, or another technical discipline.
3-6 years of hands-on application security or DevSecOps experience, including operation of SAST, SCA, and DAST capabilities in CI/CD pipelines.
Experience with at least one application security tool: Checkmarx, Veracode, Fortify, Burp Suite, OWASP ZAP, Snyk, Mend/WhiteSource, or Black Duck.
Experience integrating security controls into Jenkins, GitLab CI, GitHub Actions, or Azure DevOps, including pipeline templates, quality gates, and exception workflows; experience using Python or Bash for application security automation.
Experience performing REST or GraphQL API security testing, including authentication and authorization testing, input validation, rate limiting, broken object-level authorization, and broken function-level authorization; experience with vulnerability triage and remediation validation.
Experience conducting threat modeling and security architecture reviews for modern applications, microservices, or APIs.
Experience designing and building AI agents or agentic workflows for security or engineering use cases, including tool or function calling, multi-step orchestration, logging, guardrails, and human validation.
Preferred:
Experience applying the OWASP Application Security Verification Standard to define or validate application security requirements.
Experience implementing container or Kubernetes security, infrastructure-as-code scanning, secrets detection, or policy-as-code controls.
Experience implementing software or AI/ML supply-chain controls, including software bills of materials, model bills of materials, artifact signing or verification, dependency pinning, build provenance, model registries, or data and model lineage.
Experience applying artificial intelligence security guidance, including OWASP Top 10 for Large Language Model Applications, MITRE ATLAS, National Institute of Standards and Technology AI Risk Management Framework, or Google Secure AI Framework.
Experience implementing large language model guardrails, safety controls, or agent sandboxing patterns.
Certification in DevSecOps, cloud security, Kubernetes security, AI security, or generative AI, such as Certified Cloud Security Professional, Certified Kubernetes Security Specialist, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, Microsoft Certified: Azure AI Engineer Associate, or AWS Certified AI Practitioner.