Asst Dir (Application Security Testing)DevOps Engineer

At Moody's, we unite the brightest minds to turn today’s risks into tomorrow’s opportunities. We do this by striving to create an inclusive environment where everyone feels welcome to be who they are—with the freedom to exchange ideas, think innovatively, and listen to each other and customers in meaningful ways. Moody’s is transforming how the world sees risk. As a global leader in ratings and integrated risk assessment, we’re advancing AI to move from insight to action—enabling intelligence that not only understands complexity but responds to it. We decode risk to unlock opportunity, helping our clients navigate uncertainty with clarity, speed, and confidence.

If you are excited about this opportunity but do not meet every single requirement, please apply! You still may be a great fit for this role or other open roles. We are seeking candidates who model our values: invest in every relationship, lead with curiosity, champion diverse perspectives, turn inputs into actions, and uphold trust through integrity. 

Skills and Competencies

• 6+ years of experience in security engineering, cloud security, or Development, Security and Operations (DevSecOps), with the ability to independently address complex security challenges.
• Experience leading vulnerability management programs and applying risk-based prioritization to focus remediation on the most meaningful security findings.
• Hands-on experience with security scanning across infrastructure, containers, software dependencies, and source code.
• Experience partnering with audit and compliance teams to align technical evidence with security control requirements.
• Strong written communication skills, including the ability to develop clear technical documentation and audit-ready evidence for assessors.
• Prior security compliance experience is required. Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), cloud security certifications, and experience with security tooling and detection engineering are preferred.

Education

Bachelor’s degree in computer science, Information Security, or a related field, or equivalent practical experience.

Responsibilities

• Run continuous security scanning across infrastructure, containers, dependencies, and code.
• Prioritize vulnerabilities based on exploitability, reachability, and potential impact rather than severity scores alone.
• Track remediation timelines and document security exceptions and mitigating controls.
• Build automated checks to validate security status using live-system data.
• Prepare technical evidence and responses for assessors and reviewers, including support for significant change notifications.
• Partner with compliance teams to maintain alignment between technical evidence, documentation, and control requirements.

• Maintain Software Bills of Materials (SBOMs) and associated software supply-chain security controls.
• Lead secure design review sessions to identify and address security risks.

• Investigate and respond to suspicious activity alerts.
• Tune security detections to reduce noise and improve meaningful coverage.

About the Team

Our Banking Risk team is responsible for protecting Moody’s systems and data and demonstrating the effectiveness of our security controls.

Moody’s is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, protected veteran status, sexual orientation, gender expression, gender identity or any other characteristic protected by law.

Candidates for Moody's Corporation may be asked to disclose securities holdings pursuant to Moody’s Policy for Securities Trading and the requirements of the position. Employment is contingent upon compliance with the Policy, including remediation of positions in those holdings as necessary.