DevSecOps Application Security Engineer

About the role

The Infosys Retail, Consumer Goods, and Logistics unit partners with clients to achieve business goals through technology and services. The Infrastructure Consultant 2 will collaborate with internal and client teams to resolve incidents, assess IT infrastructure, design solutions, manage deployments, and drive automation and security initiatives.

Responsibilities

• Resolve complex incidents, perform root cause analysis, and document findings with preventive recommendations
• Evaluate client IT infrastructure, prepare assessment reports, and support due diligence for maturity and improvement opportunities
• Design scalable, cost-effective IT infrastructure solutions; review reusable components; and develop technical documentation
• Align release schedules and environment readiness; execute deployments; perform post-deployment testing; manage version control
• Coordinate maintenance, emergency fixes, and technology upgrades while ensuring integration into existing systems
• Analyze performance data, coordinate system behavior insights, and support capacity planning
• Conduct security checks, recovery drills, and compliance audits; implement security measures; coordinate continuity plans
• Identify automation opportunities, analyze infrastructure processes, and propose efficiency enhancements
• Liaise with onsite, offshore, and vendor teams to document requirements and ensure effective collaboration
• Develop a centralized repository of technical and procedural knowledge leveraging cross-project insights

Required Skills and Experience

• Application Security Testing: Conduct SAST/SCA using GHAS and DAST using Burp Suite; validate and classify vulnerabilities aligned with OWASP
• DevSecOps & Integration: Integrate GHAS into CI/CD, automate scans across SDLC, configure policies, reduce false positives, and enable shift-left security with development teams
• Vulnerability Management: Analyze findings, provide remediation guidance, track vulnerabilities through lifecycle, and support risk-based prioritization
• Reporting & Stakeholder Management: Prepare technical and executive reports, communicate findings, and support audits, compliance, and AppSec initiatives

Preferred Skills and Experience

• Conduct secure code reviews and architecture-level assessments; coordinate with development teams on secure coding and mitigation strategies
• Knowledge of SDLC and DevSecOps practices, microservices/API/cloud security, strong analytical/problem-solving skills, and stakeholder communication/consulting experience
• Exposure to SAST (Fortify, SonarQube), DAST (Netsparker, Fortify on Demand), and SCA (BlackDuck, Dependabot) tools
• Certifications: CEH, OSCP, GWAPT, CSSLP, CISSP
• Experience in threat modeling and architecture reviews

Qualifications

• Bachelor’s degree or foreign equivalent required from an accredited institution
• Three years of progressive experience in the specialty may substitute for each year of education
• Relocation and/or travel to work/project location may be required
• Candidates authorized to work for any employer in the United States without employer-based visa sponsorship are welcome to apply; Infosys cannot provide immigration sponsorship for this role

Benefits

• Medical, Dental, Vision, and Life Insurance
• Long-term and Short-term Disability
• Health and Dependent Care Reimbursement Accounts
• Accident, Critical Illness, Hospital Indemnity, and Legal Insurance
• 401(k) plan with contributions dependent on salary level
• Paid holidays plus Paid Time Off