Senior Application Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Application Security Engineer based in India.

This is a senior individual contributor role embedded directly within product engineering and focused on strengthening security throughout the software development lifecycle. You will help secure enterprise products that are deployed across customer-managed environments as well as hosted offerings. The role combines threat modeling, secure coding, vulnerability management, security testing, and software supply-chain security. You will work directly with engineers and product leaders to identify risks early and turn security requirements into practical, scalable solutions. Your work will influence what gets designed, developed, tested, released, and ultimately deployed by customers. The environment is technically hands-on, globally distributed, and focused on measurable security improvements rather than simply identifying issues. This is an opportunity to shape application security practices across multiple product lines while remaining close to production code and engineering teams.

• Lead threat modeling for critical application areas, including authentication and session management, privilege escalation, integrations, tenant isolation, cryptography, and secrets management.
• Define security requirements early in the architecture and development process, working directly with engineering teams to address risks before release.
• Assess security risks and provide clear recommendations to product and engineering leadership to support informed release and risk-acceptance decisions.
• Contribute directly to product repositories by reviewing and implementing security fixes, dependency updates, and code-level remediation in collaboration with development teams.
• Own and improve static application security testing, dynamic testing, dependency scanning, and related security tooling across product lines.
• Tune security tools to improve signal quality, reduce unnecessary disruption, and ensure findings reach the teams responsible for remediation.
• Promote secure coding practices across large C#/.NET and Java codebases through reusable patterns, libraries, reference implementations, and targeted code reviews.
• Establish appropriate security review practices for AI-assisted software development, including assessment of AI-generated code and automated remediation workflows.
• Lead product vulnerability response from intake through triage, remediation, coordinated disclosure, CVE management, and customer-facing security advisories.
• Analyze penetration-testing and bug-bounty findings to identify recurring weaknesses and implement systemic controls that prevent similar vulnerabilities.
• Own software composition analysis and SBOM generation, including software provenance and licensing information required by customers and internal stakeholders.
• Maintain security evidence that can support customer questionnaires, security reviews, certifications, and other assurance activities.
• Collaborate with engineering, product, legal, and other stakeholders to continuously strengthen application security across the product portfolio.

Requirements

• 6+ years of experience in software engineering or security, including at least 3 years focused on application or product security; equivalent professional depth may be considered.
• Demonstrated application security experience with products that customers deploy and operate within their own environments.
• Strong production-level programming skills in C# and .NET, with sufficient experience in Java to review and contribute to Java-based applications.
• Recent hands-on experience with AI-assisted development or AI-enabled security tooling, ideally within the last six months.
• Strong understanding of threat modeling and the ability to collaborate with engineering teams during the design stage.
• Experience with static analysis, dynamic application testing, software composition analysis, dependency scanning, and security tooling optimization.
• Knowledge of identity and authentication technologies and protocols such as OAuth, OIDC, SAML, and SCIM.
• Experience with coordinated vulnerability disclosure, vulnerability triage, CVE processes, and customer-facing security advisories.
• Strong secure code review capabilities across web applications and APIs.
• Understanding of software supply-chain security, SBOM standards, dependency management, and license compliance.
• Experience with cryptographic reviews, security champion programs, PCI DSS, FedRAMP, or similar security frameworks is advantageous.
• Ability to communicate complex security risks clearly to technical and non-technical stakeholders and influence senior engineers effectively.
• Strong analytical and problem-solving skills, with the judgment to prioritize security risks according to business and technical impact.
• Ability to work independently across multiple product teams while collaborating effectively within a globally distributed organization.
• Prior experience as a product or software engineer is a plus.

Benefits

• Remote working opportunity based in India.
• Senior-level ownership across multiple product lines and application security initiatives.
• Direct collaboration with engineering and product leadership.
• Opportunity to influence security architecture, secure development practices, and vulnerability management at scale.
• Hands-on exposure to modern application security, AI-assisted development, software supply-chain security, and cloud-hosted products.
• Globally distributed and collaborative working environment.
• Opportunities for professional development, learning, and career growth.
• Employee-focused health and wellbeing programs.
• Inclusive and equal-opportunity workplace committed to diversity and respect.