Sr. Engineer: Application Security

Overview

Senior Security Engineer, Application Security, in the IT Mountain Applications department. The role bridges Information Security and Software Development teams, securing the SDLC and leading a Security Champions program.

What you'll do

• Help launch and manage a formal Security Champions program, identifying advocates within development teams, providing advanced training, and building a community of practice.
• Engineer and maintain integration of security testing tools (SAST, DAST, SCA) into the CI/CD pipeline (e.g., Azure DevOps, Jenkins, GitLab) to provide rapid feedback to developers.
• Conduct manual and automated penetration tests and code reviews on web applications, APIs, and mobile apps prior to release.
• Partner with engineering teams during architecture and design to perform threat modeling (STRIDE/PASTA), identifying design flaws before code is written.
• Triage application scan results, remove false positives, and create clear, actionable Jira tickets for engineering teams.
• Create and deliver secure coding training (e.g., OWASP Top 10) tailored to the organization's technology stacks.
• Evaluate application security technologies and their reports (e.g., StackHawk, or Qualys WAS).
• Assist in developing application security standards and coding guidelines aligned with industry frameworks (ASVS, NIST).

What you'll need

• Bachelor's degree in computer science, software engineering, information security, or equivalent experience.
• Significant experience in software development or scripting (e.g., Java, .NET/C#, Python, JavaScript/Node.js); must be able to read and understand the code being secured.
• Deep understanding of the OWASP Top 10, SANS 25, and common attack vectors (SQLi, XSS, CSRF, IDOR) and their remediations.
• Hands-on experience integrating security tools into CI/CD pipelines (Azure DevOps, GitHub Actions, Jenkins).
• Experience with SAST (Static Analysis), DAST (Dynamic Analysis), and SCA (Software Composition Analysis) tools.
• Demonstrated experience building relationships with development teams or leading Security Champions initiatives.
• Strong understanding of API security, JSON Web Tokens (JWT), and API gateways.
• Ability to explain complex security exploits to non-security audiences and influence stakeholders to prioritize technical debt.
• Familiarity with securing cloud-native applications (containers, Kubernetes, Serverless) in AWS or Azure.

Nice to have

• Certifications: CASE (Certified Application Security Engineer), CSSLP, GWEB, or OSCP (Offensive Security Certified Professional).
• Experience with Qualys Web App Scanning (WAS) module.
• Experience with Infrastructure as Code (IaC) security scanning (e.g., Terraform, Ansible).
• Contribution to open-source security projects or bug bounty programs.

Details

• Location: Hyderabad, India (Raidurg Village B7 South Tower, Serilingampally Mandal, Divya Sree Orion).
• Employment type: Full time.