Lead Security Analyst
MorningstarResponsibilities
- Create, manage, and maintain Jenkins continuous integration jobs for application security automation.
- Administer static and dynamic security assessment tools and verify their automated findings.
- Communicate application security risks to internal business units and help ensure vulnerabilities are remediated promptly.
- Collect and analyze application security metrics.
- Provide security remediation advice and training to technical personnel.
- Document secure coding guidelines and run training programs for development personnel.
- Support development teams with software security and remediation guidance.
- Perform or support code reviews, architecture reviews, and penetration testing activities.
Requirements
- Bachelor’s degree and 7+ years of experience in a development or software security/penetration testing role.
- Strong understanding of software development and application security fundamentals.
- Experience with static and dynamic analysis tools such as Semgrep, Brightsec, and WAF.
- Strong understanding of security best practices in Java, JavaScript, .NET, PHP, and Ruby.
- Excellent communication skills and interest in security trends, code review, architecture review, and penetration testing.
- Understanding of authentication models such as SAML, OAuth, and OpenID is preferred.
- A software development and application security background is preferred.
Benefits
- Hybrid work environment based in Mumbai, generally with four days in-office each week.
- Additional benefits and flexibility resources are available.
Tech Stack
Categories
About Morningstar
Morningstar, Inc. is a leading provider of independent investment insights in North America, Europe, Australia, and Asia. The Company offers an extensive line of products and services for individual investors, financial advisors, asset managers and owners, retirement plan providers and sponsors, institutional investors in the debt and private capital markets, and alliances and redistributors. Morningstar provides data and research insights on a wide range of investment offerings, including managed investment products, publicly listed companies, private capital markets, debt securities, and real-time global market data. Morningstar also offers investment management services through its investment advisory subsidiaries, with approximately $369 billion in AUMA as of Sept. 30, 2025. The Company operates through wholly-owned subsidiaries in 32 countries.