Senior Engineer - Application and Platform Security (India)

Role overview

Strengthen application and product security across software, cloud infrastructure, delivery systems, and AI-powered features. This hands-on role combines security reviews and vulnerability remediation with building reusable controls, automation, and tools that help engineering teams ship safer software.

Responsibilities

- Lead design reviews and threat modeling for product changes, with attention to identity, authorization, data separation, and sensitive financial workflows. - Manually review and test web applications and APIs, investigate flaws automated scanners may miss, and verify that fixes resolve them. - Develop secure-by-default libraries, framework controls, and custom static analysis rules to prevent recurring vulnerability classes. - Triage findings from internal testing and external assessments, identify root causes, and provide actionable remediation guidance. - Assess AI features for risks such as prompt injection, unsafe tool use, data exposure, and excessive agency, then define reusable secure patterns. - Support penetration testing, supply-chain and build-pipeline security, application-security incident response, and automation that speeds reviews and triage.

Requirements

- At least five years in application or product security, or software engineering with a strong security focus. - Deep manual code-review skills, especially for authorization and business-logic vulnerabilities. - Strong Python skills and working JavaScript or TypeScript knowledge sufficient to assess client-side risks; able to produce production-quality code. - Hands-on knowledge of OAuth 2.0/OIDC, SAML, MFA, session management, and access-control models. - Experience leading threat-modeling sessions and translating findings into concrete engineering requirements. - Experience operating and tuning SAST, SCA, and DAST tools, including writing custom rules. - Working knowledge of cloud, container, and CI/CD security, and an understanding of LLM application risks. - Clear written communication and the ability to influence engineering teams without slowing delivery.

Nice to have

- Offensive web-security experience, such as bug bounties, web application CVEs, or CTFs; OSWE or BSCP certification is a plus. - Experience building developer-facing security tools or libraries, or running a security champions program. - Familiarity with OWASP ASVS or the OWASP Top 10 for LLM Applications.