Security Analyst

Enhanced Job Description: Security Analyst (InfoSec & VAPT)

Dmi Finance is seeking a highly skilled Security Analyst to lead the technical security assurance function, identifying, validating, and mitigating security weaknesses across applications, APIs, cloud, network, and endpoint environments. This role combines offensive security (VAPT), defensive operations (SOC, EDR, SIEM, WAF, DLP), secure-by-design reviews, and governance aligned with RBI, DPDP Act 2023, ISO 27001:2022, and CERT-In directives.

The ideal candidate will own and execute comprehensive security assessments, including Vulnerability Assessment and Penetration Testing (VAPT) for web, mobile, REST/API layers, internal/external networks, servers, endpoints, and cloud workloads. They will ensure findings are scored using CVSS v3.1, reproducible, and actionable, while maintaining a negative-findings register. The role demands expertise in tools like Burp Suite, Tenable WAS/VM, Nessus, Nmap, and cloud security services (AWS).

Key responsibilities include:

• VAPT Execution: Plan and execute VA/PT across platforms, covering OWASP Top 10, API Top 10, MASVS, and MITRE frameworks. Validate scanner outputs, eliminate false positives, and conduct pre-go-live security testing for new applications.
• Finding Management: Track remediation against SLAs, issue precise guidance for engineering teams, and arbitrate risk-acceptance requests. Maintain compliance with data-exposure standards and run remediation review forums.
• Security Operations: Oversee SOC operations, incident response, and threat intelligence monitoring. Ensure regulatory compliance (CERT-In, RBI, DPDP) and maintain incident response playbooks.
• Cloud & Infrastructure Security: Design AWS security architectures (VPC segmentation, IAM, KMS, ALB/WAF, Zero Trust). Automate CSPM, enforce hardening standards, and support Zero Trust Network Access (ZTNA).
• Governance & Compliance: Map controls to RBI/CERT-In/ISO 27001 frameworks, author security policies, and prepare Board-level reports. Conduct annual security audits and maintain compliance artefacts.
• Third-Party Security: Perform due diligence on vendors, challenge remediation claims, and ensure contractual security commitments.
• Security Automation: Design and build internal tooling for workflow automation, orchestration, and reporting.
• Awareness & Culture: Lead security training, phishing simulations, and advisory for product/engineering teams.

Qualifications:

• Education: Graduate (B.E./B.Tech/BCA/B.Sc. in Computer Science/IT preferred). Preferred certifications: CEH, OSCP, CompTIA Security+, AWS Security Specialty, ISO 27001 Lead Auditor, CISA/CISM.
• Experience: 2-5 years in hands-on InfoSec, with BFSI/NBFC or security-consulting exposure. Strong VAPT, SOC, and cloud security expertise.
• Technical Skills: Burp Suite, Tenable/Nessus, Nmap, AWS (EC2, VPC, IAM, RDS, S3), SIEM/EDR/WAF/DLP, Python, SQL, and documentation.

Location: Noida, New Delhi (ITO). This is a full-time position with a focus on compliance-driven security excellence in a regulated NBFC environment.