GlobalLogic
At a Glance
Senior Consultant
Engineering & Science
10-15 years
India - Bangalore, Chennai, Gurgaon, Hyderabad, Nagpur, Noida
Application Security, Application Security (AppSec), Pentesting, SAST/DAST tools (Snyk, Checkmarx), Vulnerability Management, Web Security
Hybrid
Looking for a Product Security Architect to lead our offensive and defensive security strategies. You will be embedded with engineering teams to ensure our products are resilient against sophisticated attacks. This is a “hands-on” role: you will write security-centric code, conduct deep-dive penetration tests, and automate threat detection within our pipelines. You are not just an auditor; you are a builder who solves security challenges with engineering solutions.
Technical Mastery Required
Security Frameworks: OWASP ASVS, SAMM, NIST 800-53, and Cloud Security Alliance (CSA).
Offensive Tools: Burp Suite Professional, Metasploit, Kali Linux, Nmap, and Postman (for API hacking).
Secure Coding: Deep knowledge of vulnerabilities in Java/.NET and how to prevent them (e.g., SQLi, XSS, CSRF, SSRF).
Cloud Security: Securing Kubernetes (K8s) secrets, IAM Least Privilege, and Cloud Workload Protection (CWPP).
Identity/Auth: Expert-level understanding of JWT, OAuth2, OpenID Connect, and WebAuthn/FIDO2.
Qualifications
Experience: 10+ years in Cybersecurity or Software Engineering, with 4+ years specifically in Product Security or Application Security (AppSec).
Mindset: A “Breaker” mentality balanced with a “Builder’s” empathy; the ability to explain why a vulnerability matters to a product owner.
Certifications: OSCP (Offensive Security Certified Professional)
Communication: Ability to translate complex exploitation paths into clear risk assessments for non-technical leadership.
Key Responsibilities
1. Secure Architecture & Threat Modeling
Threat Modeling: Lead structured threat modeling sessions (using STRIDE or PASTA) during the design phase to identify architectural flaws before a single line of code is written.
Architecture Reviews: Conduct deep-dive security reviews of system designs, focusing on authentication (OIDC/SAML), authorization (RBAC/ABAC), and data isolation.
Security Scaffolding: Build and maintain shared security libraries (e.g., standardized encryption wrappers, input validation modules) for use by all engineering teams.
2. Offensive Security & Exploitation
In-House Pentesting: Perform regular manual penetration tests on web applications, APIs, and cloud infrastructure to identify logic flaws that automated tools miss.
Exploitation Research: Develop PoC (Proof of Concept) exploits for discovered vulnerabilities to demonstrate impact to stakeholders and validate remediation.
Bug Bounty Management: Oversee the bug bounty program, triaging reports and working directly with developers on high-severity fixes.
3. Secure Coding & SDLC Integration
Secure Code Review: Review high-risk pull requests (e.g., changes to auth, payments, or crypto) to ensure compliance with OWASP Top 10 and ASVS.
Automation (DevSecOps): Integrate and fine-tune SAST, DAST, and SCA tools into the CI/CD pipeline to reduce “false positive” fatigue for developers.
Vulnerability Remediation: Don’t just find bugs—write the code to fix them. Pair-program with engineers to implement secure patterns.
Exciting Projects: We focus on industries like High-Tech, communication, media, healthcare, retail and telecom. Our customer list is full of fantastic global brands and leaders who love what we build for them.
Collaborative Environment: You Can expand your skills by collaborating with a diverse team of highly talented people in an open, laidback environment — or even abroad in one of our global centers or client facilities!
Work-Life Balance: GlobalLogic prioritizes work-life balance, which is why we offer flexible work schedules, opportunities to work from home, and paid time off and holidays.
Professional Development: Our dedicated Learning & Development team regularly organizes Communication skills training(GL Vantage, Toast Master),Stress Management program, professional certifications, and technical and soft skill trainings.
Excellent Benefits: We provide our employees with competitive salaries, family medical insurance, Group Term Life Insurance, Group Personal Accident Insurance , NPS(National Pension Scheme ), Periodic health awareness program, extended maternity leave, annual performance bonuses, and referral bonuses.
Fun Perks: We want you to love where you work, which is why we host sports events, cultural activities, offer food on subsidies rates, Corporate parties. Our vibrant offices also include dedicated GL Zones, rooftop decks and GL Club where you can drink coffee or tea with your colleagues over a game of table and offer discounts for popular stores and restaurants!
GlobalLogic, a Hitachi Group Company, is a trusted digital engineering partner to the world’s largest and most forward-thinking companies. Since 2000, we’ve been at the forefront of the digital revolution – helping create some of the most innovative and widely used digital products and experiences. Today we continue to collaborate with clients in transforming businesses and redefining industries through intelligent products, platforms, and services.
QA Automation Lead (Playwright / AI) IRC307024
PeruQA Automation Lead (Playwright / AI) IRC307024
ColombiaQA Automation Lead (Playwright / AI) IRC307024
UruguayQA Automation Lead (Playwright / AI) IRC307024
ChileQA Automation Lead (Playwright / AI) IRC307024
UkraineSenior Python Developer IRC307341
Load moreHi there — how can I assist you today?
Explore our services, industries, career opportunities, and more.
Source: GlobalLogic careers · View original posting
GlobalLogic is a digital product engineering services company based in San Jose, California, founded in 2000. As part of the Hitachi Group since 2021, it specializes in software product design, development, and engineering services. The company operates globally, with delivery centers in countries such as India, Slovakia, Poland, Ukraine, and Mexico. GlobalLogic offers end-to-end software development services, combining design, engineering, and data to create innovative digital products and platforms. Its expertise spans various domains, including Big Data & Analytics, Cloud Computing, Internet of Things (IoT), and Embedded Systems. The company collaborates closely with clients to co-create technologies that drive digital transformation and improve societal outcomes. GlobalLogic's services are integrated into many everyday digital experiences, supporting a wide range of clients from software startups to large industry leaders.
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
Security Philosophy
Security Team
The organizational structure and reporting line for GlobalLogic's AppSec team are not publicly available. Key public-facing leaders include Kulbhushan Bhardwaj, VP Engineering and Global Security Practice Head, whose mission is to implement a security-first culture and improve application security posture, and Alok Malik, Global IT / Security (CIO & CISO), recognized for setting up the Global Information Security Team, specifically SOC. The team size estimate is not publicly available, as a LinkedIn search did not return a reliable aggregate. As of, there is at least one active AppSec job posting. Common skill and tool patterns from job postings include expert proficiency in Web Application Penetration Testing, Secure Code Review, and strong working knowledge of at least two programming or scripting languages. Gaps include the lack of a definitive list of tools mandated by AppSec hiring or internal tool ownership.
Key Initiatives
There is no public evidence of a formal 'Security Champions' program at GlobalLogic, though security awareness is spread through 'Security tournaments' and an 'Internal Security Bug Bounty'. Their 'Shift Left' approach integrates 'security measures as a foundational element of the development process' and includes 'Threat modeling basics'. Vulnerability management intake sources include 'Dynamic application security testing (DAST)', 'Vulnerability scanning', and 'Penetration testing'. However, public statements describing triage, ticketing flows, SLA/MTTR targets, or whether AppSec assigns Jira tickets directly are not found. Secure SDLC artifacts include 'Secure Code Review' and 'Threat modeling basics'. Recent initiatives (last 6 months) include active hiring for AppSec roles, with a job posting 'Published on 19 August 2025', but no public announcements of new tooling rollouts. Gaps include no public org chart or reporting line, no public description of vulnerability triage SLAs, and no named Security Champions program.
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
Interested in this role?
Apply on GlobalLogic's site