Senior SecOps and Application Security Lead

About NeoXam and Role Context

NeoXam, a global leader in financial software with a footprint in over 25 countries, has recently acquired EZOPS, a pioneer in AI-driven reconciliation tools. The combined group supports 150+ clients and processes assets exceeding €25 trillion daily. Headquartered in Paris and staffed with over 800 employees worldwide, NeoXam is expanding its security leadership team in Noida.

Role Overview

The position of Senior SecOps & AppSec Lead is crafted for an expert to oversee security operations spanning the entire software lifecycle including coding, building, deployment, and live product environments. The lead will be accountable for managing security scanning tools, identifying and resolving vulnerabilities within application code and third-party components, and maintaining secure development and deployment practices to reinforce a robust security culture.

Core Responsibilities

• Manage and operate comprehensive security scanning pipelines utilizing tools such as Veracode, SonarQube, Trivy and others, ensuring effective vulnerability detection.
• Optimize scanning policies to minimize false positives, enforce severity thresholds, and establish quality gates that prevent flawed builds.
• Seamlessly integrate security checks into CI/CD workflows to maintain developer efficiency without compromising on security.
• Handle vulnerability triage by reproducing and assessing exploitability in real product contexts, prioritizing remediation efforts.
• Implement hands-on fixes for a wide range of security threats including SQL injection, XSS, CSRF, SSRF, and other OWASP Top 10 vulnerabilities.
• Lead application security engineering practices through rigorous code reviews and by setting secure coding standards.
• Own CI/CD pipeline health and infrastructure-as-code for security tools, maintaining deployment security and automation.
• Maintain compliance and audit readiness supporting standards like SOC 2 and ISO 27001.
• Supervise and mentor junior engineers and foster organization-wide security awareness and training programs.

Requirements

• 5–8 years of direct experience in application security or DevSecOps within enterprise software environments.
• Proficient with SAST tools such as Veracode and SonarQube for scan configuration and remediation guidance.
• Skilled in software composition analysis to detect and remediate vulnerable dependencies.
• Experience securing container environments using scanners like Trivy and applying Docker hardening techniques.
• Capable of reproducing and fixing security vulnerabilities in source code.
• Working knowledge with CI/CD systems like Jenkins or GitLab CI integrating security gates.
• Familiarity with Kubernetes security components including pod security policies, RBAC, network policies, and secret management.
• Proficiency in application languages such as Java, Python, JavaScript/TypeScript, or Go for code reviews and vulnerability fixes.
• Experience with compliance processes and audit documentation relevant to security frameworks.
• Strong communication for conveying technical risks to both technical and non-technical audiences.

Eligibility

Applicants holding degrees such as B.C.A. in any specialization, B.Tech, or B.E. in any specialization are eligible to apply.

Additional Information

This role reports to the Director of Engineering and includes direct leadership of 1-2 engineers. The candidate will be immersed in building and sustaining a security operations practice in a dynamic environment supporting extensive financial software products.