Senior Security Engineer (Security Engineer III)

Location: Bengaluru | Experience: 4 to 9 years

About Zepto:

Zepto is India's quick-commerce company, founded in 2021 and headquartered in Bengaluru.

We deliver groceries and everyday essentials in minutes through a network of 1,000+ dark stores, serving tens of millions of customers and millions of orders every day.

About the role:

Security at this scale and speed has to be built into how engineering works, not bolted on at the end. We're looking for a Senior Security Engineer who builds: security tooling, CI/CD security gates, and automation that developers actually use.

This is a hands-on role. You'll own security automation and DevSecOps, review architecture and threat models, and find real vulnerabilities in code and APIs.

What you'll do:

● Design, build, and maintain security tooling and CI/CD security gates (SAST, secrets,

SCA, IaC, container scanning)

● Write and tune custom detection rules (Semgrep, CodeQL or similar) with a focus on high signal and low noise

● Use AI coding tools to build rapid, and critically review what they produce

● Review architecture and threat models for new systems and features

● Perform secure code reviews and hands-on testing of APIs, web, and mobile backends,

including business logic flaws

● Identify and fix cloud and Kubernetes misconfigurations

● Partner with engineering teams to drive adoption, handle exceptions,



and make secure defaults the easy path

● Track the impact of what you build (false positive rate, adoption, time to fix)

● Mentor other engineers on security automation and engineering practices

What we're looking for?

Must have:

● 4+ years in application security, product security, or DevSecOps

● Track record of building and shipping security tools or automation that others rely on

● Hands-on experience integrating security into CI/CD (GitHub Actions, Jenkins, GitLab CI or similar)

● Proficiency in Python, Go, or a similar language, and comfort reading Java/Go/Node codebases

● Strong understanding of OWASP Top 10, API Security Top 10, and business logic vulnerabilities

● Working knowledge of AWS security and Kubernetes security fundamentals

● Ability to influence engineering teams without authority

Good to have:

● Open source contributions (security tools, rules, research)

● Security research: CVEs, blogs, conference talks, bug bounty track record

● Experience with ASPM platforms or vulnerability management pipelines

● Experience using LLMs in security workflows

● Background in high-scale consumer internet, e-commerce, or fintech

Why join

● Secure one of India's fastest-growing consumer platforms at real scale

● High ownership: what you build ships across the company

● Work with a hands-on team that builds, breaks, and automates

📌 Senior Security Engineer (Bengaluru)
🏢 Zepto
📍 Bengaluru