11 hours ago
Kathmandu, NepalEntry Level
Responsibilities
- Support and administer SAST, SCA, DAST, API security, secrets scanning, container scanning, and Infrastructure-as-Code security solutions.
- Validate findings, assess impact, prioritize vulnerabilities, and support remediation through verified closure.
- Perform targeted security testing of web applications, APIs, authentication and authorization controls, file handling, business logic, and data flows.
- Execute Secure SDLC and AI Development Lifecycle security activities while maintaining evidence and documentation.
- Provide developers with remediation guidance based on scans, testing findings, code reviews, and security incidents.
- Monitor software supply chain risks involving dependencies, repositories, CI/CD credentials, artifact integrity, and SBOMs.
- Maintain application catalogs, ownership information, application security profiles, testing records, findings, and risk data.
- Validate required scans, reviews, and testing before software releases.
- Support security reviews of AI-generated code and AI-enabled applications, including prompt injection, data leakage, insecure outputs, and authorization weaknesses.
- Produce security metrics, remediation reports, testing evidence, and compliance documentation, escalating complex risks when needed.
Requirements
- Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, Software Engineering, or a related field, or equivalent experience.
- 1–3 years of experience in Application Security, Security Engineering, DevSecOps, Software Development, Penetration Testing, or a related cybersecurity discipline.
- Hands-on experience with application security testing, vulnerability management, SAST, SCA, DAST, API security testing, container security, or similar technologies.
- Familiarity with Veracode, Wiz, Sysdig, Burp Suite, Postman, or equivalent platforms.
- Working knowledge of web security, API security, authentication, authorization, secure coding, cryptography, and software supply chain security.
- Experience supporting Secure SDLC, CI/CD pipelines, Git workflows, security testing, and release security controls.
- Knowledge of OWASP Top 10, OWASP API Security Top 10, MITRE CWE, NIST SSDF, HIPAA, HITRUST, SOC 2, and related frameworks.
- Strong analytical, communication, documentation, and reporting skills, with fluent written and verbal English.
- Preferred: experience with healthcare SaaS, PHI environments, cloud-native applications, containers, or multi-tenant platforms.
- Preferred: working knowledge of Python, Java, JavaScript/TypeScript, or C# and security certifications such as CompTIA Security+, CSSLP, AWS Certification, GWAPT, or GWEB.
Tech Stack
Categories
About IQVIA
IQVIA provides clinical research services, healthcare data analytics, and technology platforms to pharmaceutical, biotech, medical device, and healthcare organizations. It sells contracted R&D and commercialization services, software, and data subscriptions that help run trials, generate real-world evidence, and guide go-to-market decisions. Formed by the merger of Quintiles and IMS Health, the company is headquartered in Durham, North Carolina and is publicly traded on the NYSE (ticker: IQV).