Senior Engineer – Application and Platform Security

This is a fully remote position, open to applicants in India.

📋 Description

• Identify and address vulnerabilities within applications and cloud infrastructure.

• Establish guardrails, automation, and secure defaults.

• Oversee security design evaluations and threat models for new product functionalities.

• Conduct manual code reviews and security assessments of web applications and APIs.

• Detect authorization and business logic vulnerabilities and facilitate their resolution through verification.

• Create secure-by-default libraries, framework-level controls, and bespoke static analysis rules.

• Manage application findings from both automated and manual testing, as well as external evaluations.

• Generate actionable remediation recommendations categorized by root cause.

• Threat-model and evaluate AI-driven features for prompt injection, unsafe tool usage, data leakage, and excessive agency.

• Distribute design review and triage tasks among team members.

• Assist with external penetration testing from the initial scoping phase to retesting.

• Collaborate on build pipeline and supply chain security, particularly concerning application dependency risks.

• Engage in incident response for application security incidents.

• Develop security automation and agents to minimize review and triage durations.

⛳️ Requirements

• Minimum of 5 years in application or product security, or in software engineering with a significant focus on security.

• Extensive experience in identifying vulnerabilities through manual code reviews.

• Proficient in Python and competent in JavaScript/TypeScript.

• Capable of producing high-quality code.

• Comprehensive understanding of OAuth 2.0/OIDC, SAML, MFA, session management, and access control models.

• Practical experience in securely implementing identity and access controls.

• Proven experience leading threat modeling sessions and translating their outputs into specific requirements.

• Proficient in running and tuning SAST, SCA, and DAST, including the creation of custom rules.

• Familiarity with cloud, container, and CI/CD security.

• Understanding of risks associated with LLM applications.

• Excellent writing skills and the ability to influence engineering teams without creating bottlenecks.

• Certifications like OSWE or BSCP are advantageous but not mandatory.

• Experience in developing security tools or libraries aimed at developers.

• Background in establishing or managing a security champions program.

• Knowledge of OWASP ASVS or the OWASP Top 10 for LLM Applications.

🏝️ Benefits

• Option for a fully remote work experience.

• Flexibility to work from physical offices in Mumbai and Bangalore part-time or full-time.

• Digital-first operational approach.

• Collaboration opportunities spanning 27 U.S. states, 2 Canadian provinces, India, Luxembourg, and England.