Nykaa - Security Engineer III - Applications Security

Nykaa · Gurgaon/Gurugram

  • Experience8–12 yrs
  • SalaryNot disclosed
  • Work modeonsite
  • Levelexecutive
  • Posted21 May 2026
Apply for this job

About Nykaa

Nykaa is hiring in Gurgaon/Gurugram in ecommerce retail. This role looks for around 8+ years of experience.

Skills

  • Application Security
  • Penetration Testing
  • Software Supply Chain Security
  • DevSecOps
  • Jenkins
  • GitHub Actions
  • Software Bill of Materials (SBOM)
  • Secret Scanning
  • Branch Protection
  • Web Security Testing
  • Mobile Security Testing
  • API Security Testing
  • Microservice Architectures
  • Static Application Security Testing (SAST)
  • Dynamic Application Security Testing (DAST)
  • Web Application Firewalls (WAF)
  • Threat Modeling
  • Secure SDLC
  • GenAI Application Security
  • Java
  • JavaScript
  • Python
  • Cloud Security

The role

An application security engineer at an e-commerce product company identifies and mitigates vulnerabilities through application security, penetration testing, and software supply chain security. The role applies DevSecOps and threat modeling to microservices, APIs, mobile applications, and GenAI systems, while guiding secure coding practices.

Full job description

Role Overview :

You will be a senior security engineer within the organization responsible for identifying, triaging, and mitigating complex security vulnerabilities across the entire application suite. This role requires a seasoned specialist who thinks like an attacker to uncover deep-seated logical flaws and proactively safeguard our software ecosystem. You will act as a bridge between development and security, ensuring that everything from core microservices to cutting-edge GenAI implementations is resilient against modern threats.

Key Responsibilities :

1. Software Supply Chain Security & DevSecOps :

- Lead the implementation of Software Supply Chain Security practices, including Software Bill of Materials (SBOM) management and securing the integrity of third-party dependencies.

- Collaborate with DevOps and Development teams to integrate security best practices and guardrails into the CI/CD pipeline (Jenkins/GitHub Actions).

- Vulnerability Reachability : Reproduce and validate open-source/third-party library vulnerabilities in controlled environments to determine if the vulnerable code path is actually reachable in our product.

- Audit and manage GitHub Security Posture, ensuring robust secret scanning, branch protection, and repository security controls.

2. Advanced Vulnerability Research & Testing :

- Execute sophisticated Web, Mobile (Android/iOS), and API penetration testing.

- Go beyond checklist-based testing to identify complex logical and business flaws across the Nykaa ecosystem.

- Hands-on experience with Product Security Environments in Microservice Architectures.

- Experience with application security tools such as static analysis (SAST), dynamic analysis (DAST), and web application firewalls (WAF).

3. Security Architecture & Threat Management :

- Experience with conducting Threat Modeling Assessments during the design phase.

- Deep understanding of secure SDLC principles and their application in cloud environments.

- Experience with Securing GenAI-based Applications and understanding the unique threat landscape of LLMs.

- Familiarity with AWS and GCP environments is a strong plus.

4. Documentation & Stakeholder Management :

- Ability to clearly document findings and communicate risk effectively to technical and non-technical stakeholders.

- Support cybersecurity process activities including security requirements definition, code reviews, and cyber risk assessment.

- Mentor developers and junior engineers on secure coding practices in Java, JavaScript, and Python.

Required Skills & Qualifications :

- 8+ Years of Experience : Minimum of 8 years of hands-on experience in Application Security, Penetration Testing, or Product Security.

- Certifications (Preferred) : Highly prefer candidates with hands-on certifications such as OSCP, OSEP, or OSWE.

- Technical Mastery : Expert-level proficiency in Web, Mobile (iOS/Android), and API security testing.

- Supply Chain Knowledge : Familiarity with securing software supply chains and third-party risk management.

- Code Proficiency : Strong ability to read and debug software development languages (e.g., Java, JavaScript, Python).

- Cloud Fluency : Practical knowledge of securing cloud-native applications in AWS or GCP.