Senior Engineer - Application and Platform Security

Accountabilities • Lead security design reviews and threat-modeling sessions for new product features, with particular attention to authentication, authorization, data isolation, and sensitive financial workflows.

• Conduct manual code reviews and security testing of web applications and APIs to identify authorization weaknesses, business logic vulnerabilities, and other issues that automated scanners may miss.

• Drive vulnerability remediation from discovery through verification, providing clear, actionable guidance that enables engineering teams to implement effective fixes.

• Design secure-by-default libraries, framework-level protections, and custom static analysis rules that prevent recurring vulnerabilities across applications.

• Triage security findings from automated tools, manual testing, and external assessments, identifying root causes and prioritizing remediation efforts.

• Assess AI-powered product features for risks such as prompt injection, unsafe tool execution, sensitive data leakage, and excessive agent autonomy, and establish reusable security patterns.

• Collaborate with platform security teammates on build pipeline protection, software supply-chain security, and application dependency risks.

• Support external penetration testing programs, including assessment scoping, coordination, remediation tracking, and retesting.

• Participate in incident response activities related to application security events and contribute to ongoing improvements in security controls.

• Develop security automation, developer-facing tools, and AI-powered agents that streamline security reviews, vulnerability triage, and remediation workflows.

• Share responsibility for security design reviews and finding triage while collaborating with engineering teams to integrate security into everyday development practices.

Requirements

• At least 5 years of experience in application security, product security, or software engineering with a strong focus on security.

• Extensive hands-on experience identifying vulnerabilities through manual code review, particularly authorization flaws, access control weaknesses, and business logic issues.

• Strong Python programming skills and working proficiency in JavaScript or TypeScript, including the ability to review front-end code for client-side security vulnerabilities.

• Ability to write production-quality software and build maintainable security tools, rather than relying exclusively on scripts or off-the-shelf scanners.

• In-depth knowledge of identity and access management, including OAuth 2.0, OpenID Connect (OIDC), SAML, multi-factor authentication (MFA), session management, and access control models.

• Demonstrated experience leading threat-modeling sessions with engineering teams and translating identified risks into practical security requirements.

• Experience operating and tuning Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Dynamic Application Security Testing (DAST) tools, including developing custom detection rules.

• Working knowledge of cloud security, container security, CI/CD pipelines, and the relationship between application design and infrastructure-level risks.

• Understanding of large language model application security risks, with a willingness to deepen expertise in AI security and agent-based systems.

• Strong written and verbal communication skills, with the ability to influence engineering teams, explain complex security issues clearly, and promote secure development without creating unnecessary bottlenecks.

• Preferred: Background in offensive web security, such as bug bounty programs, web application CVEs, or Capture the Flag (CTF) challenges.

• Preferred: Security certifications such as OSWE or BSCP.

• Preferred: Experience developing security libraries, developer-facing security tools, or a security champions program.

• Preferred: Familiarity with the OWASP Application Security Verification Standard (ASVS) or the OWASP Top 10 for LLM Applications.

Benefits

• Fully remote working arrangement based in India.

• Opportunity to work on application security, cloud infrastructure, and emerging AI security challenges.

• Hands-on ownership of security engineering initiatives with the ability to influence product design and engineering practices.

• Opportunities to build production-quality security tools, reusable frameworks, and AI-powered automation.

• Collaboration with engineering teams in a digital-first working environment.

• Compensation, healthcare coverage, paid leave, and other employee benefits have not been specified and should be confirmed during the hiring process.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1