SoftwareONE Hiring for Manager – Security GRC at Chennai, India Full Time

Why SoftwareOne? SoftwareOne is a leading global software and cloud solutions provider that is redefining how companies build, buy and manage everything in the cloud. By helping clients to migrate and modernize their workloads and applications – and in parallel, to navigate and optimize the resulting software and cloud changes – SoftwareOne unlocks the value of technology. The company’s 8,900 employees are driven to deliver a portfolio of 7,500 software brands with sales and delivery capabilities in 90 countries. Headquartered in Switzerland, SoftwareOne is listed on the SIX Swiss Exchange under the ticker symbol SWON. Visit us at https://www.softwareone.com/e The role As a Manager – Security Assurance/ VAPT Lead plans and oversees the delivery of testing services to determine whether infrastructure components, systems and applications meet confidentiality, integrity, authentication, availability, authorization and non-repudiation standards. He/She reports on testing outcomes and activities. He provides recommendations and manages stakeholder expectations. He ensures compliance with assessment and testing standards, processes and tools. He develops organizational testing capability and supports knowledge management. He is well versed with cyber security standards, protocols and frameworks, and has sound knowledge of various testing applications and services. The Vulnerability Assessment and Penetration Testing Manager possesses strong analytical and critical thinking abilities to resolve and advise on highly complex issues, and effectively communicates outcomes to relevant stakeholders. He is adept at managing resources and developing his team. Your excellent spoken language skills will be used for communication with customers and internal stakeholders and management for all level of technology and status updates. Manage VAPT Deliverables : • Plan technology / resources for Assurance Team for successful execution of assurance function • Propose corrections and recommendations to improve and facilitate certification of software • Provide advice based on security VAPT considerations • Communicate the outcome of testing initiatives and results to the stakeholder groups • Approve documentation to certify penetration testing results • Develop frameworks and dashboards for the reporting of VAPT results Oversee vulnerability assessment and penetration testing (VAPT) activities: • Recommend strategies and techniques to mitigate identified risks • Design service strategies and scope for security testing technologies and solutions • Drive cyber security awareness within the organization • Recommend strategic and operational changes to security testing to address new threats • Provide advice on complex security test data analysis to support security vulnerability assessment processes, including root cause analysis • Establish test metrics to benchmark against requirements and industry best practices • Monitor the conduct of certification tests, audits, inspections and reviews • Act as an escalation point on issues, dependencies, and risks related to security testing • Lead team members to continuously improve testing capabilities • Incorporate emerging security and risk management trends, issues, and alerts in penetration testing activities Manage people and organization: • Review the utilization of resources • Implement succession planning initiatives for key management positions • Review operational strategies, policies and targets across teams and projects • Oversee the development of learning roadmaps for teams and functions • Establish performance indicators to benchmark effectiveness of learning and development programs against best practices • Develop strategies for resource planning and utilization • Assists with the development and maintenance of IT security measurement and reporting systems to aid in monitoring effectiveness of IT Security programs. • Develop, revise and maintenance Standard Operating Procedures and Working Instructions of the SOC to the high standards and support/train VAPT Analysts. • Develop and maintain good communications and working relationships with teams and external clients. What we need to see from you • Minimum 8 to 10 years of experience working with security technologies, SOC, monitoring, detecting, triaging and supporting security solutions • Bachelor’s degree preferably in Computer Science or Information Systems and /or equivalent formal training or work experience • In-depth Experience of Static & dynamic application code Security testing tool deployment, Infrastructure vulnerability tool • Experience and good understanding of Security Testing of application and Audit principles and associated compensating controls • Experience and good understanding of: o Vulnerability Assessment of network and host-based security platforms o Audit principles and associated compensating controls • Experience on Security tools majorly Tenable and Qualys • Integration of testing mechanisms with industry best practices such as OWASP & NIST. • Improving and maintaining secure development standards. • Providing standard gap analysis services to internal business and technology partners. • Good Understanding of IT security policy, procedure, design, and implementation. • In-depth knowledge of vulnerability scanning & compliance tools or security analytics toolsets • In-depth experience in Mobile Application Testing and API testing • Knowledge of system security vulnerabilities and remediation techniques. • Solid foundation of common software vulnerabilities and their mitigation Techniques • Good Understanding of IT security policy, procedure, design, and implementation. • Basic Knowledge on security models such as ITIL, ISO27002, PCI DSS and Cobit 5 • OSCP, LPT, Crest Certifications Preferred Process Skills: • Installing and Configuring Tenable IO, Burp Suite, Qualys, Metasploit environments • Secure Tenable server and Enable SSL • Integrating Tenable products with services such as (but not limited to) LDAP, Active Directory, and CyberArk. • Provide status reports on weekly and monthly basis • Identify gaps between present operations and best practices based on • Tool recommendations and security requirements • Documents procedures and instructions for operating Tenable and Qualys • Communicate on all technical issues with other departments, including busines customers, program leads, and other engineering/administrative teams. • Recommend improvements to the configuration of Security Center; deployment and documentation of improvements at the direction of the Lead GRC • Responsibilities for installing and configuring Nessus Agents, Creation of tenable Organizations, Repositories, and Scan Zones. • Local and LDAP based user management • Configuring Tenable plugins/feeds and adding audit files • Adding scan policies, audit policies, and credentials to Security Center • Behavioral Skills: • Effective interpersonal, team building, team management and communication skills • Ability to collaborate; be able to communicate clearly and concisely both to laypeople and peers, be able to follow instructions, make a team stronger for your presence and not weaker. • Ability to see the bigger picture and differing perspectives; to compromise, to balance competing priorities, and to prioritize the user. • Desire for continuous improvement, of the worthy sort; always be learning and seeking improvement, avoid change aversion and excessive conservatism, equally avoid harmful perfectionism, “not-invented-here”syndrome and damaging pursuit of the bleeding edge for its own sake. • Learn things quickly, while working outside the area of expertise. • Analyze a problem and realize exactly what all will be affected by even the smallest of change you make in your design • Ability to communicate complex technology to no tech audience in simple and precise manner. Job Function Business IT

• Minimum 8 to 10 years of experience working with security technologies, SOC, monitoring, detecting, triaging and supporting security solutions • Bachelor’s degree preferably in Computer Science or Information Systems and /or equivalent formal training or work experience • In-depth Experience of Static & dynamic application code Security testing tool deployment, Infrastructure vulnerability tool • Experience and good understanding of Security Testing of application and Audit principles and associated compensating controls • Experience and good understanding of: o Vulnerability Assessment of network and host-based security platforms o Audit principles and associated compensating controls • Experience on Security tools majorly Tenable and Qualys • Integration of testing mechanisms with industry best practices such as OWASP & NIST. • Improving and maintaining secure development standards. • Providing standard gap analysis services to internal business and technology partners. • Good Understanding of IT security policy, procedure, design, and implementation. • In-depth knowledge of vulnerability scanning & compliance tools or security analytics toolsets • In-depth experience in Mobile Application Testing and API testing • Knowledge of system security vulnerabilities and remediation techniques. • Solid foundation of common software vulnerabilities and their mitigation Techniques • Good Understanding of IT security policy, procedure, design, and implementation. • Basic Knowledge on security models such as ITIL, ISO27002, PCI DSS and Cobit 5 • OSCP, LPT, Crest Certifications Preferred Process Skills: • Installing and Configuring Tenable IO, Burp Suite, Qualys, Metasploit environments • Secure Tenable server and Enable SSL • Integrating Tenable products with services such as (but not limited to) LDAP, Active Directory, and CyberArk. • Provide status reports on weekly and monthly basis • Identify gaps between present operations and best practices based on • Tool recommendations and security requirements • Documents procedures and instructions for operating Tenable and Qualys • Communicate on all technical issues with other departments, including busines customers, program leads, and other engineering/administrative teams. • Recommend improvements to the configuration of Security Center; deployment and documentation of improvements at the direction of the Lead GRC • Responsibilities for installing and configuring Nessus Agents, Creation of tenable Organizations, Repositories, and Scan Zones. • Local and LDAP based user management • Configuring Tenable plugins/feeds and adding audit files • Adding scan policies, audit policies, and credentials to Security Center • Behavioral Skills: • Effective interpersonal, team building, team management and communication skills • Ability to collaborate; be able to communicate clearly and concisely both to laypeople and peers, be able to follow instructions, make a team stronger for your presence and not weaker. • Ability to see the bigger picture and differing perspectives; to compromise, to balance competing priorities, and to prioritize the user. • Desire for continuous improvement, of the worthy sort; always be learning and seeking improvement, avoid change aversion and excessive conservatism, equally avoid harmful perfectionism, “not-invented-here”syndrome and damaging pursuit of the bleeding edge for its own sake. • Learn things quickly, while working outside the area of expertise. • Analyze a problem and realize exactly what all will be affected by even the smallest of change you make in your design • Ability to communicate complex technology to no tech audience in simple and precise manner.

As a Manager – Security Assurance/ VAPT Lead plans and oversees the delivery of testing services to determine whether infrastructure components, systems and applications meet confidentiality, integrity, authentication, availability, authorization and non-repudiation standards. He/She reports on testing outcomes and activities. He provides recommendations and manages stakeholder expectations. He ensures compliance with assessment and testing standards, processes and tools. He develops organizational testing capability and supports knowledge management. He is well versed with cyber security standards, protocols and frameworks, and has sound knowledge of various testing applications and services. The Vulnerability Assessment and Penetration Testing Manager possesses strong analytical and critical thinking abilities to resolve and advise on highly complex issues, and effectively communicates outcomes to relevant stakeholders. He is adept at managing resources and developing his team. Your excellent spoken language skills will be used for communication with customers and internal stakeholders and management for all level of technology and status updates. Manage VAPT Deliverables : • Plan technology / resources for Assurance Team for successful execution of assurance function • Propose corrections and recommendations to improve and facilitate certification of software • Provide advice based on security VAPT considerations • Communicate the outcome of testing initiatives and results to the stakeholder groups • Approve documentation to certify penetration testing results • Develop frameworks and dashboards for the reporting of VAPT results Oversee vulnerability assessment and penetration testing (VAPT) activities: • Recommend strategies and techniques to mitigate identified risks • Design service strategies and scope for security testing technologies and solutions • Drive cyber security awareness within the organization • Recommend strategic and operational changes to security testing to address new threats • Provide advice on complex security test data analysis to support security vulnerability assessment processes, including root cause analysis • Establish test metrics to benchmark against requirements and industry best practices • Monitor the conduct of certification tests, audits, inspections and reviews • Act as an escalation point on issues, dependencies, and risks related to security testing • Lead team members to continuously improve testing capabilities • Incorporate emerging security and risk management trends, issues, and alerts in penetration testing activities Manage people and organization: • Review the utilization of resources • Implement succession planning initiatives for key management positions • Review operational strategies, policies and targets across teams and projects • Oversee the development of learning roadmaps for teams and functions • Establish performance indicators to benchmark effectiveness of learning and development programs against best practices • Develop strategies for resource planning and utilization • Assists with the development and maintenance of IT security measurement and reporting systems to aid in monitoring effectiveness of IT Security programs. • Develop, revise and maintenance Standard Operating Procedures and Working Instructions of the SOC to the high standards and support/train VAPT Analysts. • Develop and maintain good communications and working relationships with teams and external clients.