Digital India Corporation is inviting applications for the position of Application Security (AppSec) Specialist on a contractual basis.

Responsibilities

• Threat-model the platform end-to-end and review the secure design of multi-tenancy (tenant_id isolation and bound tenant predicates), the deny-by-default / fail-closed security filters, and the separated three- key trust model (fleet JWT secret, platform-admin signing key, internal-service key — kept distinct and never merged).
• Conduct secure code reviews across the Java / Spring engines and the Next.js application — covering authentication (BCrypt password hashing, lockout, session limits, token lifecycle), authorization (RBAC / ABAC/policy), input validation, injection prevention (allow-listed identifiers, parameterised queries) and secret handling (AES-256-GCM at rest) — and drive remediation to closure.
• Plan and coordinate VAPT / penetration testing and vulnerability assessments across the fleet and the web / API surface; triage SAST / DAST / SCA findings, assign severities and track fixes.
• Own DPDP (Act 2023 / Rules 2025) compliance review — data-flow and data-inventory mapping, consent, retention, data-minimisation and cross-tenant data-isolation controls — and the immutable audit trail (append-only store, SHA-256 integrity, field-level diff).
• Review and advise on the documented residual hardening items (e.g. RS256 / JWKS token hardening and token revocation, platform MFA) and verify closure as they are addressed; define the secure-coding and security-testing standards the team follows.
• Prepare security evidence and documentation for STQC clearance and government security audit, and support incident response for security events.

Important Links

About Digital India Corporation

Digital India Corporation has been set up by the ‘Ministry of Electronics & Information Technology, Government of India’ to innovate, develop and deploy ICT and other emerging technologies for the benefit of the common man. It is a ‘not-for-profit’ company under Section 8 of the Companies Act 2013. The company has been spearheading the Digital India programme of the Government of India, and is involved in promoting the use of technology for e-Governance/e-Health / Telemedicine, e-agriculture, e-Payments, etc. The Digital India programme promotes safety and security concerns of the growing cashless economy and addresses challenges confronting its wider acceptance. It also promotes innovation and evolves models for the empowerment of citizens through Digital initiatives and promotes participatory governance and citizen engagement across the government through various platforms, including social media.