Senior Staff Engineer, Product Security

Overview

Join Druva as a hands-on Senior Staff Product Security Engineer to lead initiatives across product security. Architect an AI-first SDLC, integrate traditional AppSec with advanced AI security practices, automate shift-left pipelines, threat-model core services and complex AI architectures, and help secure SaaS products and agentic features.

What you'll do

• Architect and embed AI-driven security controls, including SAST, DAST, SCA, container security and secrets detection, into CI/CD build pipelines and developer workflows.
• Establish an intelligent, highly automated AI-first SDLC.
• Leverage AI tooling for auto-triage, threat-model drafting and fix generation.
• Strategize security controls for product-facing AI features.
• Assess risks in Generative and Agentic AI architectures, including MCP integrations, autonomous agents, tool-calling interfaces, multi-agent communication, prompt injections and memory/context poisoning.
• Review code in Python, Go, Javascript and other languages.
• Triage findings and partner with engineering to implement robust short- and long-term security fixes.
• Manage third-party open-source risks, open-source dependency tracking, Software Bills of Materials (SBOMs) and secure MCP/agent server ecosystems.
• Conduct secure coding workshops.
• Train developers on secure AI usage.
• Help grow an active Security Champions network.
• Partner with engineering leadership, Information Security, GRC, BuildOps and DevOps teams.

What you'll need

• 6–10 years of product security engineering experience in a SaaS environment.
• A proven track record of technical leadership.
• Deep expertise in OWASP Top 10, CWE 25, threat modeling, cryptography, container security and secure SDLC frameworks, including SAMM and Microsoft SDL.
• Strong hands-on expertise with AI-first SDLC methodologies.
• Experience reviewing AI security risks around Agentic AI systems, MCP security, including authorization, tool poisoning and confused deputy risks, and LLM security controls.
• Experience using AI tools to optimize security engineering workflows, including automating root-cause analysis, threat modeling assistance and automated policy generation.
• Proficiency in code review and scripting with Python, Go or Javascript.
• Hands-on experience with Burp Suite, Snyk, OWASP ZAP and CI/CD security scanners.
• Bachelor’s degree in CS/IT or equivalent.

Nice to have

• Hands-on development experience.
• Relevant certifications such as OSCP, OSWE, CSSLP or GIAC.
• Active community contributions to OWASP, BSides, NullCon, Black Hat or similar communities.

Details

• Location: Pune, Maharashtra, India.
• Experience level: 6–10 years.
• Domain: Product Security / AppSec / DevSecOps / AI Security / AI-First SDLC.