About the Role

We are looking for a hands-on Security Engineer with 1–3 years of experience in Application Security or Product Security, preferably within FinTech, authentication products, banking, NBFCs, or other regulated industries.

In this role, you will be responsible for securing our applications, APIs, authentication systems, and cloud infrastructure. You will work closely with engineering teams to identify vulnerabilities, improve security architecture, and implement practical security controls that protect our products and customers.

We're looking for someone who has been involved in responding to real-world security incidents—such as fraud, customer-impacting security issues, production breaches, ransomware, or data leaks—and has actively contributed to investigation, remediation, and strengthening security defenses.

What You'll Do

- Perform secure code reviews for applications developed in Java, Python, JavaScript, Golang,or other languages.
- Conduct application security assessments using SAST, DAST, SCA, and manual testing.
- Perform threat modeling and identify security risks during the design phase.
- Validate and prioritize vulnerabilities discovered through security testing.
- Work closely with developers to remediate security findings.
- Integrate security tools into CI/CD pipelines.
- Conduct penetration testing and security assessments of web applications and APIs.
- Develop secure coding standards and security guidelines.
- Support vulnerability management and remediation tracking.
- Educate development teams on secure coding practices and common vulnerabilities (OWASP Top 10, API Security Top 10, CWE).
- Participate in security architecture reviews.
- Assist in incident response and root cause analysis for application security issues.

What We're Looking For

- Bachelor's degree in Computer Science, Information Security,



or a related field.
- Strong understanding of application security principles.
- Experience with:
- - SAST (Checkmarx, Fortify, SonarQube, Semgrep, CodeQL)
- DAST (Burp Suite, OWASP ZAP)
- SCA (Snyk, Mend, Black Duck, Dependency-Check)
- Container security (Trivy, Prisma Cloud, Aqua)

- Knowledge of:
- - OWASP Top 10
- OWASP ASVS
- OWASP API Security Top 10
- CWE
- CVSS
- Secure SDLC

- Experience securing REST APIs, microservices, and cloud-native applications.
- Familiarity with authentication and authorization mechanisms (OAuth 2.0, OpenID Connect, JWT, SAML).
- Knowledge of cloud platforms (AWS, Azure, or GCP).
- Understanding of DevSecOps practices and CI/CD tools (Jenkins, GitHub Actions, GitLab CI, Azure DevOps).
- Familiarity with infrastructure as code security (Terraform, CloudFormation).
- Experience using Git.

Bonus

- Experience working in Financial Services, Banking, NBFC, FinTech, Identity & Authentication products, or other regulated industries.
- Familiarity with SIEM platforms, security monitoring, and alert triage.
- Knowledge of secrets management solutions (HashiCorp Vault, AWS Secrets Manager).
- Experience with bug bounty programs.
- Familiarity with threat intelligence and MITRE ATT&CK.;
- Experience developing security automation scripts using Python, PowerShell, or Bash.

What's in It for You

- Prospect to build secure, scalable products that protect millions of users.
- High ownership with the ability to influence security architecture and engineering practices.
- Collaborative engineering culture focused on practical security and continuous improvement.
- Competitive compensation and comprehensive benefits.
- Flexible work environment with opportunities for professional growth and learning.
- Work alongside experienced engineers solving complex security challenges in a fast-growing organization.

📌 AppSec Security Enginer (Bengaluru)
🏢 Are you in?
📍 Bengaluru