Application Security Engineer (AppSec Engineer) - Bengaluru

Overview

Application Security Engineer (AppSec Engineer) to improve the security posture of products and platforms through end-to-end security testing and secure development practices.

What you'll do

• Perform end-to-end security testing across Web, Mobile, and Thick Client applications.
• Lead threat modelling and secure design/architecture reviews with product and engineering teams.
• Conduct secure code reviews (manual and via tools such as Semgrep) and security feature assessments.
• Implement security automation for testing and code review workflows (e.g., Semgrep in CI/CD).
• Run root cause and variant analysis for high-severity (P0/P1) vulnerabilities and guide remediation.
• Collaborate with incident response and bug bounty/triage teams to evaluate externally reported issues.

What you'll need

• 5 to 8 years of experience in the security domain, specifically Application/Product Security.
• Expertise in Web, Mobile, and Thick Client security testing.
• Experience with threat modelling and secure design review.
• Ability to run manual code reviews across multiple languages and frameworks.
• Experience using security tools such as Semgrep and SAST/DAST tools.
• Proficiency with Java, Kotlin, Swift, JavaScript, Python, and C#/.NET.

Nice to have

• Hands-on experience with CI/CD security automation, container security, and cloud environments (AWS/GCP/Azure).
• Relevant security certifications (e.g., OSWE, OSCP, OSEP, GWAPT, GMOB) or equivalent.
• Experience with bug bounty programs, VDPs, or vulnerability triage.
• Track record of security community contributions (e.g., blogs, talks, open-source tools, CVEs).

Details

• Location: Bengaluru, India.
• Work type: Hybrid; 3 days a week in the local office and work from home the remaining days.
• Travel expectation: 5% (domestic/international only if business demands).