Want to know if this job is worth applying to?
India
Remote only
This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior Engineer – Application and Platform Security based in India.
We are seeking a Senior Engineer specializing in application and platform security to strengthen the security of applications, cloud infrastructure, and AI-powered products. In this fully remote role, you will identify and remediate complex vulnerabilities while building secure-by-default frameworks, automation, and developer-friendly security tools. You will work closely with engineering teams to conduct threat modeling, review application code, and protect sensitive data and high-risk financial workflows. The role combines hands-on software development with security engineering, giving you the opportunity to prevent entire classes of vulnerabilities rather than simply react to individual findings. You will also help address emerging risks associated with large language models and AI agents. This is an opportunity to shape security practices across a collaborative engineering environment while using automation and AI to improve the effectiveness of security operations.
Lead security design reviews and threat-modeling sessions for new product features, with particular attention to authentication, authorization, data isolation, and sensitive financial workflows.
Conduct manual code reviews and security testing of web applications and APIs to identify authorization weaknesses, business logic vulnerabilities, and other issues that automated scanners may miss.
Drive vulnerability remediation from discovery through verification, providing clear, actionable guidance that enables engineering teams to implement effective fixes.
Design secure-by-default libraries, framework-level protections, and custom static analysis rules that prevent recurring vulnerabilities across applications.
Triage security findings from automated tools, manual testing, and external assessments, identifying root causes and prioritizing remediation efforts.
Assess AI-powered product features for risks such as prompt injection, unsafe tool execution, sensitive data leakage, and excessive agent autonomy, and establish reusable security patterns.
Collaborate with platform security teammates on build pipeline protection, software supply-chain security, and application dependency risks.
Support external penetration testing programs, including assessment scoping, coordination, remediation tracking, and retesting.
Participate in incident response activities related to application security events and contribute to ongoing improvements in security controls.
Develop security automation, developer-facing tools, and AI-powered agents that streamline security reviews, vulnerability triage, and remediation workflows.
Share responsibility for security design reviews and finding triage while collaborating with engineering teams to integrate security into everyday development practices.
At least 5 years of experience in application security, product security, or software engineering with a strong focus on security.
Extensive hands-on experience identifying vulnerabilities through manual code review, particularly authorization flaws, access control weaknesses, and business logic issues.
Strong Python programming skills and working proficiency in JavaScript or TypeScript, including the ability to review front-end code for client-side security vulnerabilities.
Ability to write production-quality software and build maintainable security tools, rather than relying exclusively on scripts or off-the-shelf scanners.
In-depth knowledge of identity and access management, including OAuth 2.0, OpenID Connect (OIDC), SAML, multi-factor authentication (MFA), session management, and access control models.
Demonstrated experience leading threat-modeling sessions with engineering teams and translating identified risks into practical security requirements.
Experience operating and tuning Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Dynamic Application Security Testing (DAST) tools, including developing custom detection rules.
Working knowledge of cloud security, container security, CI/CD pipelines, and the relationship between application design and infrastructure-level risks.
Understanding of large language model application security risks, with a willingness to deepen expertise in AI security and agent-based systems.
Strong written and verbal communication skills, with the ability to influence engineering teams, explain complex security issues clearly, and promote secure development without creating unnecessary bottlenecks.
Preferred: Background in offensive web security, such as bug bounty programs, web application CVEs, or Capture the Flag (CTF) challenges.
Preferred: Security certifications such as OSWE or BSCP.
Preferred: Experience developing security libraries, developer-facing security tools, or a security champions program.
Preferred: Familiarity with the OWASP Application Security Verification Standard (ASVS) or the OWASP Top 10 for LLM Applications.
Fully remote working arrangement based in India.
Opportunity to work on application security, cloud infrastructure, and emerging AI security challenges.
Hands-on ownership of security engineering initiatives with the ability to influence product design and engineering practices.
Opportunities to build production-quality security tools, reusable frameworks, and AI-powered automation.
Collaboration with engineering teams in a digital-first working environment.
Compensation, healthcare coverage, paid leave, and other employee benefits have not been specified and should be confirmed during the hiring process.
