Senior Engineer - Application and Platform Security (India)

Overview

Senior Engineer on the Platform Engineering team, focused on application and platform security. Find and fix vulnerabilities across applications and cloud infrastructure, then build the guardrails, automation, and secure defaults that prevent them from recurring.

What you'll do

• Lead security design reviews and threat models for new product features, with depth in authentication, authorization, data isolation, and high-risk financial workflows.
• Perform manual code review and security testing of web applications and APIs, focusing on authorization and business logic flaws that scanners miss, and drive fixes through to verification.
• Design secure-by-default libraries, framework-level controls, and custom static analysis rules that eliminate whole classes of vulnerabilities.
• Triage application findings from automated and manual testing and external assessments, group them by root cause, and write remediation guidance engineers can act on.
• Threat-model and test AI-powered product features against risks such as prompt injection, unsafe tool use, data leakage, and excessive agency, and define secure patterns other teams can reuse.
• Share design review and triage responsibilities across the team.
• Support the external penetration testing program, from scoping through retest.
• Partner with teammates on build pipeline and supply-chain security, especially dependency risk in application code.
• Participate in incident response for application security events.
• Build security automation and agents that cut review and triage time.

What you'll need

• 5+ years in application or product security, or in software engineering with a strong security focus.
• Deep experience finding vulnerabilities through manual code review, including authorization and business logic flaws.
• Strong Python, plus working proficiency in JavaScript/TypeScript sufficient to review front-end code for client-side issues; able to write production-quality code.
• In-depth knowledge of OAuth 2.0/OIDC, SAML, MFA, session management, and access control models, with hands-on experience implementing them securely.
• Experience leading threat modeling sessions with engineering teams and turning the output into concrete requirements.
• Experience running and tuning SAST, SCA, and DAST, including writing custom rules.
• Working knowledge of cloud, container, and CI/CD security, sufficient to reason about how application design interacts with infrastructure.
• A working understanding of LLM application risks.
• Clear writing and a track record of influencing engineering teams without becoming a bottleneck.

Nice to have

• An offensive web security background, such as bug bounty, web application CVEs, or CTFs. Certifications such as OSWE or BSCP are a plus, not a requirement.
• Experience building developer-facing security tooling or libraries.
• Experience building or running a security champions program.
• Familiarity with OWASP ASVS or the OWASP Top 10 for LLM Applications.

Details

• Location: India.