What You'll Do
Avalara is seeking a Security Engineer to join our Application Security team. In this role you will be tasked with designing, implementing and deploying security engineering tooling for our code scanning and web scanning pipelines across our software development lifecycle (SDLC). This role will help us scale the traditional application security CICD code scanning processes into automated pipelines to find security vulnerabilities such as XSS, SSRF, RCE, CSRF and SQLi across Avalara’s code base, using a hybrid of algorithmic and AI-driven technologies.
You will leverage your software engineering skills and security knowledge to help uplift the security posture of our products and SaaS services while enabling engineering teams to deliver secure software at scale. The ideal candidate combines deep technical expertise in application security, software engineering, and cloud-native technologies with a passion for solving complex security challenges through automation and collaboration. This role will report into the Senior Manager of Application Security.
What Your Responsibilities Will Be
Design, build and deploy microservice-based automation leveraging manually discovered findings to scale automated scanning and vulnerability discovery efforts
Build effective vulnerability triage process including contextual severity analysis, remediation plan, root-cause-analysis, mitigation strategies
Identify tooling gaps in static and energetic scanning technologies and build out tooling to correct coverage and findings accuracy, including but not limited to SAST, DAST, SCA, and Secrets Scanning
Provide security guidance and consultancy to engineering service owners to remediate known vulnerabilities. Build company-wide remediation burndowns plans.
Perform threat modelling, design, and code reviews on an as-needed basis to assess software security and service posture, to lead future product roadmaps and requirements.
Leverage AI to augment existing platform security
📌 Security Engineer (India)
🏢 Avalara
📍 India