Sr. Product Security Engineer

Overview

Senior individual-contributor Product Security Engineer for Xylem’s Global Product Security Engineering team in India, focused on security assessments for cloud-hosted applications and APIs.

What you'll do

• Lead security assessments of cloud-hosted applications and APIs using business logic, threat model, and architecture.
• Assess identity and access control implementations including OAuth2/OIDC, SAML, and JWT.
• Produce assessment reports with context for engineering and product leadership’s risk-based decisions.
• Partner with engineering and product teams through the resolution process to evaluate risk-reduction controls.
• Conduct threat modeling and architecture reviews early in the design process.
• Contribute to security standards, assessment methodologies, and tooling across the portfolio.
• Support PSIRT as needed for externally reported security issues and coordinated disclosure.

What you'll need

• Demonstrated hands-on product/application security experience as a core responsibility.
• Experience conducting thorough security assessments of cloud-hosted applications and APIs.
• Strong knowledge of web application and API failure classes including OWASP Top 10 and OWASP API Security Top 10.
• Experience assessing modern identity and access control at design and implementation levels (OAuth2/OIDC, SAML, JWT).
• Ability to write proof-of-concept code with scripting ability to demonstrate findings impact and support automation.
• Working knowledge of cloud architectures, microservices, and container-based deployments.
• Bachelor’s degree in Computer Science/Engineering/Information Security or equivalent practical experience.

Details

• Location: Bangalore, India.