Senior Security Engineer (Security Engineer III)

Location: Bengaluru | Experience: 4 to 9 years

About Zepto:

Zepto is India's quick-commerce company, founded in 2021 and headquartered in Bengaluru.

We deliver groceries and everyday essentials in minutes through a network of 1,000+ dark

stores, serving tens of millions of customers and millions of orders every day.

About the role:

Security at this scale and speed has to be built into how engineering works, not bolted on at the

end. We're looking for a Senior Security Engineer who builds: security tooling, CI/CD security

gates, and automation that developers actually use.

This is a hands-on role. You'll own security automation and DevSecOps, review architecture and

threat models, and find real vulnerabilities in code and APIs.

What you'll do:

● Design, build, and maintain security tooling and CI/CD security gates (SAST, secrets,

SCA, IaC, container scanning)

● Write and tune custom detection rules (Semgrep, CodeQL or similar) with a focus on

high signal and low noise

● Use AI coding tools to build fast, and critically review what they produce

● Review architecture and threat models for current systems and features

● Perform secure code reviews and hands-on testing of APIs, web, and mobile backends,

including business logic flaws

● Identify and fix cloud and Kubernetes misconfigurations

● Partner with engineering teams to drive adoption, handle exceptions, and make secure





defaults the easy path

● Track the impact of what you build (false positive rate, adoption, time to fix)

● Mentor other engineers on security automation and engineering practices

What we're looking for

Must have:

● 4+ years in application security, product security, or DevSecOps

● Track record of building and shipping security tools or automation that others rely on

● Hands-on experience integrating security into CI/CD (GitHub Actions, Jenkins, GitLab CI

or similar)

● Proficiency in Python, Go, or a similar language, and comfort reading Java/Go/Node

codebases

● Strong understanding of OWASP Top 10, API Security Top 10, and business logic

vulnerabilities

● Working knowledge of AWS security and Kubernetes security fundamentals

● Ability to influence engineering teams without authority

Good to have:

● Open source contributions (security tools, rules, research)

● Security research: CVEs, blogs, conference talks, bug bounty track record

● Experience with ASPM platforms or vulnerability management pipelines

● Experience using LLMs in security workflows

● Background in high-scale consumer internet, e-commerce, or fintech

Why join

● Secure one of India's fastest-growing consumer platforms at real scale

● High ownership: what you build ships across the company

● Work with a hands-on team that builds, breaks, and automates

📌 Senior Security Engineer (Bengaluru)
🏢 Zepto
📍 Bengaluru