Senior Product Security and Compliance Engineer

Overview

The Principal Product Security Engineer is a senior technical leader responsible for safeguarding product and service security across the full SDLC, with an emphasis on hands-on application penetration testing.

What you'll do

• Lead and execute manual application penetration testing for web apps, APIs, and LLM/AI-enabled applications.
• Perform security testing aligned with OWASP and CWE vulnerability categories and emerging attack classes.
• Identify complex attack paths, chained vulnerabilities, and business-logic flaws beyond automated tool results.
• Validate exploitability, determine real risk, and differentiate true positives from noise.
• Conduct secure code reviews and support remediation; re-test fixes to confirm effectiveness.
• Integrate security into SDLC and DevSecOps workflows, including CI/CD pipelines and security tool usage.

What you'll need

• 7+ years of experience in product security, application security, or software security engineering.
• Extensive hands-on experience conducting manual application penetration testing.
• Strong understanding of secure software development lifecycle (SSDLC) principles.
• Deep knowledge of OWASP Top 10, OWASP API Top 10, OWASP LLM/AI Top 10, CWE, CVSS, and vulnerability prioritization.
• Proficiency in at least one programming language such as Python, Java, JavaScript/TypeScript, Go, or C/C++.
• Experience integrating security controls into CI/CD pipelines.

Nice to have

• Relevant certifications such as OSCP, GWAPT, OSWE, GPEN, CISSP, CSSLP, or CCSP.

Details

• Location: Pune, India.