Staff Engineer, Software Security

Overview

Staff Product Security Engineer focused on bridging AppSec with AI security for Druva’s SaaS products. You will automate security into CI/CD, run threat modeling for AI/agentic architectures, and drive vulnerability remediation with engineering teams.

What you'll do

• Integrate and maintain automated security controls (SAST, DAST, SCA, container, secrets detection) in CI/CD pipelines and developer workflows.
• Use operational AI tooling for tasks like auto-triage, threat-model drafting, and fix generation while strategizing AI security controls.
• Conduct threat modeling for Generative and Agentic AI architectures, including prompt injection and memory/context poisoning.
• Review code and triage security findings, partnering with engineering to implement short- and long-term fixes.
• Manage software supply chain and integrity tasks such as open-source dependency tracking and SBOMs.
• Run secure coding workshops and help build a Security Champions enablement program.

What you'll need

• 3–5 years of security engineering experience in a SaaS product company.
• Deep expertise in OWASP Top 10, CWE 25, threat modeling, cryptography, container security, and secure SDLC frameworks (SAMM, Microsoft SDL).
• Hands-on experience reviewing AI security risks for Agentic AI systems, including MCP security risks.
• Experience using AI tools to optimize security engineering workflows (e.g., root-cause analysis, threat modeling assistance, automated policy generation).
• Proficiency in code review and scripting with Python, Go, or JavaScript (hands-on development is a plus).
• Hands-on with tools like Burp Suite, Snyk, OWASP ZAP, and CI/CD security scanners.

Details

• Location: Pune, Maharashtra, India.