Secure Development & Application Security
• Implement security checks, scanning, and quality gates across the SDLC, and champion secure coding and remediation practices.
• Review authentication, authorization, APIs, tenant isolation, and access controls — identifying and mitigating OWASP and API security risks through threat modelling.
• Assess AI agents, prompts, connectors, and data-access risks, protecting against prompt injection, data leakage, tool misuse, and unsafe AI actions. Cloud & CI/CD Security
• Secure Google Cloud environments — IAM, service accounts, networking, secrets, and workloads — enforcing least privilege and environment separation.
• Harden GitHub Actions, dependencies, and deployment pipelines with secret protection, SCA, SBOM, and secure release processes.
Vulnerability Management & Monitoring
• Establish a process to identify, prioritize, and track vulnerabilities, coordinating remediation and validating fixes.
• Strengthen security logging, alerting, and investigation capability, and support incident response, RCA, and security drills.
• Maintain audit-ready security evidence, and support penetration testing, compliance activity, and security architecture documentation.