Senior application security engineer

Senior Application/Product Security Engineer

This is a hands-on role for someone who wants to work inside engineering delivery: reviewing code and designs, helping developers fix security issues, improving CI/CD security checks, and driving product-security findings to verified closure.

Role:

Perform hands-on security reviews of applications, APIs, services, and supporting components. Review pull requests, application designs, authentication and authorization flows, secrets handling, logging, and data-exposure risks. Triage SAST, SCA, DAST, secret-scanning, container-scanning, penetration-test, and product vulnerability findings. Work directly with developers to implement secure fixes and reduce recurring issue classes. Improve CI/CD security checks, branch protection, merge controls, and release-readiness signals. Support secure-design reviews, focused application security testing, and remediation validation. Coach developers and help identify local Security Champions.

Required Skills:

Atleast 8+ yrs hands-on experience in application security, product security, Dev Sec Ops, or software security engineering. Proven ability to work directly with developers to fix security issues in code, configuration, and delivery pipelines. Experience triaging and remediating vulnerabilities in large or legacy codebases. Practical experience with SAST, SCA, DAST, secret scanning, container scanning, and vulnerability management workflows. Ability to read and review application code in languages such as Java,. NET, Java Script / Type Script, Python, or similar. Strong understanding of web, API, authorization, session, secrets, dependency, logging, and secure deployment risks. Comfortable working inside engineering rhythms: standups, sprint planning, pull requests, release readiness, and backlog refinement.

Good to have:

Experience with cloud-native environments, AWS, Kubernetes, or containers. Experience with legacy modernization, dependency remediation, software-supply-chain risk, or product vulnerability management. OSCP, CSSLP, CISSP, GWAPT, cloud security, secure software, or application security certifications.