About the Role

We are looking for a hands-on Senior Product Security Engineer to secure enterprise applications and AI-powered products across multiple engineering teams and repositories.

In this role, you will identify and validate real-world vulnerabilities through manual security testing, source-code analysis, threat modeling, and AI red teaming. You will work directly with engineering teams to prioritize risks, drive remediation, and verify fixes across fast-moving development environments.

You will also help strengthen the security of AI-powered applications and agents by identifying emerging risks such as prompt injection, sensitive-data leakage, insecure tool execution, and authorization bypasses.

This is an prospect for a security engineer who enjoys solving complex technical problems, going beyond automated scanners, and building practical security controls that scale across products.

Key Responsibilities

- Perform hands-on security assessments across enterprise applications, APIs, AI-powered products, and multiple code repositories.
- Discover, exploit, validate, and document vulnerabilities through manual testing, source-code review, and security tools.
- Assess web applications and APIs for authentication and authorization weaknesses, business logic flaws, injection vulnerabilities, and other OWASP Top 10 risks.
- Test AI/LLM applications and agents for direct and indirect prompt injection, sensitive-data exposure, insecure tool execution, excessive permissions, and access-control bypasses.
- Conduct threat modeling, architecture reviews, and attack-path analysis to identify security gaps before they reach production.
- Assess cloud environments, IAM policies, containers, Kubernetes workloads, and CI/CD pipelines for security weaknesses.
- Prioritize vulnerabilities based on exploitability, business impact, exposure, and potential consequences—not just scanner severity scores.




- Partner with engineering teams to explain findings, recommend practical fixes, resolve remediation blockers, and verify fixes through retesting.
- Integrate security controls into the software development lifecycle using SAST, DAST, SCA, secrets detection, and automated security gates.
- Develop repeatable security testing approaches, automation, and remediation practices that scale across products and engineering teams.
- Communicate technical findings, business risks, and remediation priorities clearly to technical and non-technical stakeholders.

Required Qualifications
- 2 years of relevant experience in Application Security, Product Security, Application Security Engineering, or Offensive Security.
- Strong hands-on experience in web application and API security testing, including manually discovering, exploiting, and validating vulnerabilities.
- Solid understanding of the OWASP Top 10, authentication and authorization flaws, IDOR/BOLA, business logic vulnerabilities, and common web/API attack paths.
- Practical experience using Burp Suite Professional or OWASP ZAP for security testing.
- Experience with source-code security reviews, root-cause analysis, threat modeling, and remediation validation.
- Hands-on exposure to AI/LLM application security testing, including prompt injection, data leakage, or insecure AI agent/tool execution.
- Familiarity with cloud security, IAM, containers, Kubernetes, and CI/CD security practices.
- Experience working with application security tools such as SAST, DAST, SCA, and secrets detection.
- Ability to assess security risks independently, distinguish exploitable vulnerabilities from low-impact findings, and recommend actionable remediation.
- Demonstrated ownership of security findings from discovery and validation through remediation, retesting, and closure.
- Strong analytical, problem-solving, collaboration, and communication skills.

📌 Security Engineer (Bengaluru)
🏢 Techolution
📍 Bengaluru