Application Security II

We are looking for a Senior Security Engineer to identify, investigate, and mitigate complex security vulnerabilities across our application ecosystem. This role is ideal for a security professional with a strong attacker mindset, deep expertise in Application/Product Security and Penetration Testing, and the ability to work closely with Engineering and DevOps teams to secure modern microservices, cloud-native applications, and GenAI solutions.

The candidate will have responsibilities across the following functions:

Application and Product Security:

Perform advanced security assessments across Web, Mobile (Android/iOS), APIs, and Microservices.

Conduct penetration testing to uncover logical, business-logic, and deep application vulnerabilities beyond standard checklists.

Identify, triage, reproduce, and validate complex security vulnerabilities.

Perform security-focused code reviews and support secure SDLC initiatives.

Software Supply Chain and DevSecOps:

Drive Software Supply Chain Security, including SBOM management and third-party dependency security.

Analyse and validate vulnerability reachability to determine whether vulnerable code paths are actually exploitable within the product.

Integrate security guardrails into CI/CD pipelines using Jenkins and GitHub Actions.

Strengthen GitHub security posture through secret scanning, branch protection, repository security controls, and related practices.

Work closely with Development and DevOps teams to embed security throughout the SDLC.

Cloud and Security Architecture:

Conduct Threat Modeling during application and feature design.

Assess security architecture of cloud-native and microservice-based applications.

Apply secure SDLC principles across AWS/GCP environments.

Work with security tools and technologies including SAST, DAST, and WAF.

GenAI Security:

Assess and secure GenAI/LLM-powered applications.

Understand and mitigate emerging LLM security risks such as prompt injection, data leakage, insecure tool/function usage, and application-level AI threats.

Partner with engineering teams to build security controls into AI-enabled products.

Collaboration and Security Advocacy:

Communicate vulnerabilities, business impact, and remediation strategies clearly to technical and non-technical stakeholders.

Define security requirements and contribute to cyber risk assessments.

Mentor developers and junior security engineers on secure coding practices.

Requirements:

Hands-on experience in Application Security, Product Security, Penetration Testing, or Vulnerability Research.

Strong expertise in Web, Mobile (iOS/Android), and API Security.

Strong understanding of OWASP, secure SDLC, threat modelling, vulnerability management, and application security.

Experience securing microservices and cloud-native applications.

Knowledge of Software Supply Chain Security, SBOM, third-party dependencies, and vulnerability reachability.

Hands-on experience with SAST, DAST, WAF, CI/CD security, and GitHub security controls.

Strong ability to read, understand, debug, and review code in Java, JavaScript, and/or Python.

Practical experience with AWS and/or GCP security.

Strong understanding of modern GenAI/LLM security threats is a plus.

Strong analytical and problem-solving skills with an attacker mindset.

Preferred Certifications: OSCP, OSEP, OSWE.

Ideal Candidate:

A seasoned security professional who can think like an attacker, understand application internals, reproduce vulnerabilities, assess exploitability, and work with engineering teams to fix security issues at their root.

Keywords: Application Security, Product Security, VAPT, Penetration Testing, Vulnerability Research, Web Security, API Security, Mobile Security, OWASP, Threat Modelling, DevSecOps, Software Supply Chain Security, SBOM, Vulnerability Reachability, SAST, DAST, WAF, CI/CD Security, GitHub Security, AWS, GCP, Microservices Security, GenAI Security, LLM Security, Secure SDLC, OSCP, OSEP, OSWE.