Service Delivery Expert - AppSec SAST

Job Description

15 Petabyte of data hosted, 49 countries supported, 15000 servers and thousands of devices to connect locations and businesses.Information is clearly one of Novartis` most valuable asset. In ISRM (Information Security and Risk Management), we implement and maintain solutions that secure the Novartis environment, protect our data and provide the necessary control framework to enable compliance with the various regulations associated with the healthcare industry.105,000 outstanding individuals work with Novartis all with different needs and aspirations. Aligned to a single inspirational purpose to reimagine medicine for millions of patients across the world. Join us and directly contribute to Novartis vision to Reimagine Medicine.Your Responsibilities Include but are not limited to: Represent IT to the business or IT groups receiving services, ensuring that expectations for IT services are met. -Identify and qualify new demand with overall responsibility for steering proposals through the early phases of approval; participate in establishment of budgets and investment proposals and obtain sponsorship and funding. Ensure the introduction of new / modified services happens in a planned, controlled and timely manner to minimize disruption and maximize benefit. -Create the detailed IT solution/service design, based on functional specifications, to meet quality and performance requirements and technical constraints. -Develop, build, configure, customize and unit test solutions based on the functional and technical specifications to meet quality and performance requirements. Hold end to end accountability for business processes, integrate services horizontally across organizational units, and manage interfaces between Service Delivery projects. , Lead and execute secure code scanning (SAST) of varied coding languages using one or more commercial and open source tools e.g., Checkmarx, Fortify Investigate reported code security vulnerabilities and triage for false positive removal Manual review of custom code and scripts where tooling may not be able to support , Perform quality review of SAST/SCA outcomes performed by other team and or external vendors , Provide expertise in resolving technical and process hurdles faced by internal/external teams to perform code security testing, Recommend security controls and/or corrective actions for mitigating technical and business risk , Provide remediation guidance and support to application and project teams on technical vulnerabilities/risks Maintain and report on metrics to demonstrate assessment coverage and remediation effectiveness , Build and manage strong collaborative working relationships with IT, business and vendor teams, Manage AppSec test delivery and ensure customer satisfaction with practical guidance to understand vulnerabilities and remediate Enable continuous testing in Agile/DevOps and improvement of manual and automated processes , Support Developer training and education on code security and secure development Manage the SAST solution, integrations with DevOps solutions and troubleshooting , Monitor and optimize technology configurations and policies as needed for specific applicationsMinimum requirements Minimum Requirements: 9 - 12 years of experience in IT security with major years relevant to Code development and Code Security 2-3 years of experience in leading teams and security testing Demonstrated understanding of the relationship between security policies/standards and other control mechanisms Knowledge of coding languages such as Java, .Net, Python, ABAP, APEX, PHP, C# and ability to learn new languages as needed for security testing scope. Hands-on expertise with DevSecOps and Agile methodologies and code security technology integration in DevOps Good communication and writing skills to be able to translate technical assessment outcomes into business context Certification in Information Security, such as GWAPT, CREST, OSWE, CSSLP, CISSP, or equivalent in application security and Secure Code DevelopmentWhy consider Novartis 799 million. That s how many lives our products touched in 2019. And while we re proud of that fact, in this world of digital and technological transformation, we must also ask ourselves this: how can we continue to improve and extend even more people s lives We believe the answers are found when curious, courageous and collaborative people like you are brought together in an inspiring environment. Where you re given opportunities to explore the power of digital and data. Where you re empowered to risk failure by taking smart risks, and where you re surrounded by people who share your determination to tackle the world s toughest medical challenges.Imagine what you could do at Novartis!,

Keyskills :
it securityopen sourceit servicesproject teamswriting skillsservice deliverysecurity testingcoding languagescontrol frameworksecurity controlscorrective actionsagile methodologiesinformation security