Lead Security Analyst

The Area: The Information Security department is responsible for setting enterprise security policies and standards that are designed to protect the confidentiality, integrity and availability of Morningstar information. The security team offers guidance and technical expertise in areas like application security, policies and procedures, disaster recovery and compliance/regulation. We analyze emerging security threats and conduct risk and vulnerability assessments to ensure that our information remains secure. The Role: The Lead Security Analyst will assist in supporting Morningstar’s application security automation program. This individual will help integrate static and dynamic security analysis tools into Morningstar’s continuous integration processes, assist with security remediation activities, ensure that vulnerabilities are being remediated in a timely manner and support development and technical personnel as required. This position is based in our Mumbai location. Responsibilities + Create, manage and maintain Jenkins continuous integration jobs to support application security automation + Administer common static and dynamic security assessment tools + Verify automated application security findings that result from automated static and dynamic assessments + Work directly with internal business units to communicate risks and to help ensure open vulnerabilities are resolved in a timely manner + Collect and analyze application security metrics + Provide security remediation advice and training to technical personnel + Assist with documenting secure coding guidelines and running training programs to assist internal development personnel + Provide software security support and remediation guidance to development personnel Requirements + A bachelor’s degree and 7+ years’ experience in a development or software security / penetration testing role + We’re looking for someone who enjoys breaking code, solving puzzles, and diagnosing problems + Excellent communication skills and a strong understanding of software development and application security fundamentals + Candidates should be interested in keeping up with the latest security trends, as well as enjoy performing code / architecture reviews and penetration test activities + Experience with common static and dynamic analysis tools (Semgrep, Brightsec, WAF etc.) + A strong understanding of security best practices in Java, JavaScript, .NET, PHP and Ruby programming languages + Strong understanding of common authentication models (SAML, OAuth, OpenID, etc.) is preferred + A software development and application security background is preferred Morningstar is an equal opportunity employer.