Thank you for considering a career at Ensemble Health Partners India!
Ensemble Health Partners - The single solution for a frictionless revenue cycle with the purpose of redefining the possible in healthcare by empowering people to be the difference. Our India Office is an extension of Ensemble’s team and culture designed to augment and enhance our talent and skill base in Revenue Cycle Management in addition to our long-standing presence in technology. Leveraging our platform of services, technology, business intelligence and analytics, our teams are creating and maintaining innovative products and systems to help our revenue cycle operators achieve the most efficient, ideal outcomes for our clients. Our teams are certified in revenue cycle best practices and are supporting end-to-end RCM operations. We are at the forefront of innovation using cutting-edge technology to drive meaningful impact in the Revenue Cycle Management landscape. As a leading player in the industry, we offer an environment that fosters growth, creativity, and collaboration, where your expertise will be valued, and your contributions will make a difference.
The Opportunity:
Job Title: Application Security Architect
Experience: 12+ Years
Job Location: Hyderabad (Hybrid)
Position Summary:
We are looking for a hands-on **Application Security Architect** who combines strong software engineering skills with deep application security expertise. This is a generalist role — you should be comfortable reading and writing production-quality code across multiple languages, and equally comfortable designing and running an AppSec program that spans SAST, DAST, and SCA tooling, secure architecture reviews, and developer enablement. This position will require occasional after-hours and weekend work. The selected candidate will be expected to attend work on a regular and predictable schedule in accordance with agency leave policy and perform other duties as assigned.
Key Responsibilities
Design and drive the application security strategy across the SDLC — from design reviews through CI/CD to production.
Own and continuously tune **SAST** (e.g., Checkmarx, Fortify, Semgrep, CodeQL), **DAST** (e.g., Burp Suite Enterprise, OWASP ZAP, Invicti), and **SCA** (e.g., Snyk, Black Duck, Mend, Dependency-Track) tooling — integration, rule tuning, false-positive reduction, and coverage.
Perform secure architecture and design reviews for new features, services, and major system changes.
Read, write, and refactor code (not just review it) to build internal tooling, PoCs for vulnerabilities, custom scanners, and secure-by-default libraries/frameworks.
Conduct manual code reviews and threat modeling for high-risk services, complementing automated tooling.
Partner with engineering teams to remediate vulnerabilities, and act as a technical escalation point for security findings.
Build and maintain CI/CD security gates (pre-commit hooks, pipeline scanning, break-the-build policies).
Define and evangelize secure coding standards, guardrails, and reusable security patterns/libraries.
Run or support penetration tests and coordinate remediation with engineering.
Mentor developers and security champions; deliver secure coding training.
Track and report AppSec metrics (vulnerability density, MTTR, tool coverage, false-positive rates) to leadership.
Stay current on emerging threats (OWASP Top 10, CWE/SANS Top 25, supply chain attacks) and evolve the program accordingly.
Required Skills:
**Engineering foundation (must-have — this is a generalist coding role, not a pure GRC/tooling role): **
Strong hands-on software development experience in at least one backend language (e.g., Java, Python, Go, Node.js, C#) and working familiarity with others.
Comfortable reading and writing code across the stack — APIs, web front ends, mobile, or infrastructure-as-code, as relevant to your environment.
Solid understanding of software design patterns, frameworks, and modern CI/CD pipelines.
**Application security…