Senior Application Security Engineer

Overview

Design and build the application security controls, automation and AI-powered tooling that let HPE engineering teams ship securely by default, from first commit to production. Work as a peer to engineering, architecture and DevOps leaders and own outcomes across secure SDLC, CI/CD and supply chain integrity, WAF/WAAP and API protection, and AI/LLM security.

What you'll do

• Build security into the SDLC as paved roads so the secure path is the easiest path for every engineering team.
• Define the secure coding standards and reference patterns that teams across the enterprise build against.
• Build the vulnerability prioritization capability that shows where real risk sits across code, pipelines and deployed services, and drive remediation to measurable closure.
• Establish a threat modeling practice for applications, APIs and delivery pipelines that scales beyond a single team.
• Architect the security control layer for CI/CD platforms (GitHub Actions, Jenkins, GitLab, Azure DevOps) so every pipeline inherits it by default.
• Design the automated testing pipeline that runs SAST, DAST, SCA and container scanning on every build, tuned for signal over noise.
• Build the automation that keeps the attack surface visible: API discovery, dependency scanning, SBOM generation and secrets detection.
• Build reusable AI agent skills and workflows inside CI/CD (e.g., agentic coding tools, MCP-based integrations) that review every pull request for insecure patterns, authN/authZ gaps, secrets exposure and risky dependency changes, delivering CWE/OWASP-mapped findings developers can act on.
• Build AI-driven security testing that generates targeted test cases (API abuse cases, fuzzing inputs, prompt-injection and jailbreak suites), triages SAST/SCA/DAST results to cut false positives, and proposes remediation PRs for human review.
• Define the guardrails AI agents operate under in pipelines: least-privilege tokens, human-in-the-loop approval, output-accuracy evaluation and audit logging.
• Build the AI-specific scanning capability that catches insecure LLM orchestration patterns before they ship.
• Establish a reusable threat modeling approach for RAG architectures and autonomous agents.
• Define the framework for secure AI adoption in enterprise applications, covering data security, access controls, model input/output handling and misuse prevention.
• Drive initiatives end-to-end, taking ownership of tasks, deliverables and outcomes.
• Shape product, platform and DevOps roadmaps as a trusted advisor, translating technical risk into business decisions.
• Choose, implement and prove the tooling that closes current gaps, with metrics that show impact.
• Grow security capability inside engineering teams by mentoring secure coding and pipeline practices.
• Help scale the Security Champions program into a self-sustaining network.

What you'll need

• 6+ years in Application Security, Product Security or Secure Software Development, with a track record of building capabilities, not only operating them.
• Has designed security controls for CI/CD pipelines and source repositories (GitHub, GitLab, Jenkins, or similar) at scale.
• Has built and tuned SAST, DAST, SCA and container scanning so developers trust and act on the results.
• Has built and tuned WAF and API protections and driven vulnerability remediation to closure.
• Applies SLSA and NIST SSDF to design build integrity, including secrets management and artifact signing.
• Has designed security controls in AWS, Azure or GCP.
• Deep understanding of OWASP Top 10 (Web and API), CWE and secure coding practices.
• Working knowledge of OWASP Top 10 for LLM Applications and MITRE ATLAS.
• Familiarity with agentic AI frameworks such as LangGraph and similar orchestration frameworks.
• Writes production-quality code in at least one language (Python, Java, Go, or JavaScript/Node.js) to build automation and tooling.

Nice to have

• Has built LLM-powered developer or security tooling, including prompt/skill design, tool and MCP integration, and evaluation of output quality and false-positive rates.
• Has implemented signing and provenance with Sigstore/Cosign or similar tooling.
• Integrates SBOM generation and SCA into CI/CD workflows.
• Has deployed runtime protection (API security platforms, RASP, container EDR).
• Has built GitOps, IaC scanning (Terraform, CloudFormation) and policy-as-code guardrails.
• Has led or shaped response to software supply chain or dependency poisoning incidents.
• Relevant certifications: OSWE, CSSLP, GPCS, GWEB, GCSA.

Details

• Remote/Teleworker role: primarily works from home.
• Location line: Bengaluru, Karnātaka, India.
• Job level: TCP_04; job family: Information Technology.