Experience required
- 6+ years

About the Role
HCL Software is seeking a Secure Development Engineer to design secure software systems and embed security throughout how our products are developed, built, packaged, and released. This role combines ownership of secure architecture reviews and secure design reviews with hands-on coding, security automation, software supply chain security, SBOM management, and DevOps engineering. You will work directly with product engineering, Product Security, Security Architecture, and platform teams to translate security requirements into practical designs, working code, and automated controls. You will lead reviews, identify risks, implement solutions, and verify that security improvements work in production environments. This role requires a self-starter who can move between architecture analysis, threat modeling, secure code review, development, and CI/CD troubleshooting. You must be comfortable writing and maintaining production-quality code, implementing security fixes, and building automation across diverse product environments. The ideal candidate combines open-source, commercial, and in-house technologies into maintainable solutions. Success means engineering teams adopt secure designs, remediate vulnerabilities effectively, and deliver software with reliable security controls and release evidence.

Key Responsibilities
Secure Architecture and Design Reviews
• Lead secure architecture reviews for recent products, major enhancements, APIs, microservices, cloud deployments, and third-party integrations.
• Conduct secure design reviews before implementation, assessing authentication, authorization, trust boundaries, data flows, tenant isolation, encryption, secrets management, and failure handling.
• Perform threat modeling with engineering teams to identify attack paths, abuse cases, and security requirements.
• Develop reusable reference architectures, secure design patterns, and implementation guidance for product teams.
• Document review findings, design decisions, remediation requirements, and risk-based exceptions; verify that agreed mitigations are implemented.
• Evaluate existing architectures and recommend practical security improvements for legacy and modern environments. Hands-on Coding and Security Automation
• Write, test, debug, and maintain production-quality code, security tooling, shared libraries, APIs, and automation using Python, Java, C++, or other relevant languages.
• Conduct manual secure code reviews to identify vulnerabilities, insecure implementation patterns, and deviations from approved designs.
• Implement security fixes directly or work alongside developers to remediate issues and add regression tests.
• Build automation for security testing, finding enrichment, vulnerability triage, remediation tracking, and release evidence collection.
• Develop prototypes and proof-of-concept implementations to validate security designs and proposed controls.
• Integrate open-source, commercial, and in-house tools into reliable engineering workflows. Hands-on DevOps and Pipeline Security Engineering
• Build, maintain, secure, and troubleshoot CI/CD pipelines using GitHub Actions, GitLab CI, Jenkins, Azure DevOps, or equivalent platforms.
• Integrate static analysis, software composition analysis, secrets detection, container scanning, and infrastructure-as-code scanning across product groups.




• Tune scanning configurations to improve finding accuracy and reduce false positives.
• Implement risk-based security gates with documented, time-bound exception workflows.
• Create reusable pipeline templates, shared libraries, and build and deployment patterns that incorporate security controls by default.
• Provision and harden infrastructure using Terraform or equivalent tooling, with hands-on work across cloud platforms, Linux, containers, Kubernetes, and artifact registries.
• Secure build runners, service identities, credentials, secrets, and artifact promotion between environments.
• Work with engineering teams to diagnose build and deployment failures and operationalize security controls across different toolchains. Software Supply Chain Security and SBOM
• Automate Software Bill of Materials (SBOM) generation, validation, publication, and retention across product builds and releases, with CycloneDX preferred and SPDX supported where required.
• Ensure SBOMs accurately represent shipped artifacts and their direct and transitive dependencies.
• Integrate SBOM and software composition analysis workflows with dependency intelligence platforms to identify affected products and releases when vulnerabilities are disclosed.
• Implement artifact signing, build provenance, attestations, dependency pinning, trusted package sources, and build reproducibility improvements.
• Operate Dependency-Track or comparable tooling and automate dependency risk assessment and remediation workflows.
• Support supply chain assurance requirements and maintain evidence for product and customer attestations. Developer Enablement
• Provide hands-on guidance on secure architecture, secure design, coding practices, and vulnerability remediation.
• Deliver actionable security findings within developer workflows, including pull requests, IDEs, and CI/CD pipelines.
• Maintain implementation examples, reusable security components, documentation, and engineering guidance.
• Track architecture and design review coverage, control adoption, remediation progress, and recurring security issues.
• Work with engineering leaders to close gaps and improve secure development practices across distributed teams. Compliance and Release Assurance
• Automate collection of release-time security evidence for audits, customer questionnaires, contractual commitments, and regulatory reporting.
• Partner with Product Security and PSIRT on vulnerability triage, impact assessment, fix verification, and advisory support.
• Contribute to secure development lifecycle standards and translate them into implementable design requirements, code checks, and pipeline controls.
• Verify that required security reviews, remediation actions, SBOMs, and supply chain evidence are available for release decisions. Required Qualifications
• 5+ years of experience in secure software development, application security, DevSecOps, or platform engineering,



with demonstrated ownership of secure architecture and design reviews.
• Strong software engineering fundamentals and recent hands-on experience writing, testing, debugging, and maintaining production-quality code in Python, Java, C++, or comparable languages.
• Practical experience conducting threat modeling, secure architecture reviews, secure design reviews, and manual secure code reviews.
• Demonstrated ability to translate security findings into architecture changes, code fixes, automated checks, and deployment controls.
• Hands-on experience building, operating, and troubleshooting CI/CD pipelines and integrating security tooling into development and release workflows.
• Practical DevOps experience with Git, Linux, containers, Kubernetes, artifact registries, deployment automation, and infrastructure as code.
• Cloud platform proficiency in AWS, Azure, or GCP, including identity, networking, secrets management, and security controls.
• Experience with software composition analysis, SBOM generation and validation, dependency risk management, and software supply chain security.
• Ability to collaborate with and influence engineering teams across geographically distributed environments.
• Strong technical documentation skills, including architecture diagrams, review findings, implementation guidance, and security requirements. General Security Expertise
• Strong understanding of security principles, secure development practices, common application vulnerabilities, and modern cloud and web threats.
• Working knowledge of OWASP guidance and NIST secure development practices.
• Proficiency in designing secure systems, including application and API security, authentication, authorization, data protection, and appropriate use of cryptography.
• Experience identifying security flaws in code and implementing fixes and hardening measures across diverse codebases.
• Knowledge of Linux security and container and Kubernetes hardening, including image security, workload permissions, and registry controls.
• Understanding of supply chain risks across source code, dependencies, build systems, artifacts, and release processes.
• Experience with SCA and SBOM tooling such as Mend, Trivy, Dependency-Track, or comparable technologies.
• Ability to translate vulnerability assessment, penetration testing, or reverse engineering findings into preventive design and engineering improvements.
• Experience developing security automation and supporting responses to product security vulnerabilities.
• Excellent communication skills and the ability to explain security risks and implementation tradeoffs to developers, architects, and engineering leaders. Preferred Qualifications
• Experience in a product company shipping enterprise software under contractual security obligations.
• Familiarity with SLSA, NIST SSDF (SP 800-218), and in-toto attestations.
• Experience implementing artifact signing, provenance verification, and supply chain integrity controls.
• Experience operating Dependency-Track or comparable dependency intelligence platforms at scale.
• Experience securing AI-assisted development workflows and reviewing AI-generated code.
• Certifications valued but not required: CSSLP, GWEB, cloud security certifications, or Kubernetes security credentials.
Good to have Certification Please share CV to [email protected]

📌 Secure Product Development Engineer (Bengaluru)
🏢 HCLSoftware
📍 Bengaluru