Application Security Engineer III

We are looking for an experienced Application Security Engineer III to strengthen product security across web, mobile, API, and cloud-native applications. The ideal candidate should have strong expertise in penetration testing, vulnerability research, software supply chain security, and secure SDLC, along with exposure to securing GenAI-based applications.

Responsibilities:

• Lead software supply chain security initiatives, including SBOM management and third-party dependency security.
• Integrate security controls and guardrails into CI/CD pipelines using Jenkins/GitHub Actions.
• Perform vulnerability reachability analysis by reproducing and validating third-party library vulnerabilities.
• Manage GitHub security posture, including secret scanning, branch protection, and repository security.
• Conduct advanced web, mobile (Android/iOS), and API penetration testing.
• Identify complex business logic vulnerabilities across microservices-based applications.
• Perform threat modeling, security architecture reviews, and secure SDLC assessments.
• Secure GenAI/LLM-based applications against emerging security threats.
• Conduct security reviews, code reviews, and risk assessments while mentoring developers on secure coding practices.

Requirements:

• 6-10 years of experience in application security/product security/penetration testing.
• Strong hands-on expertise in web, mobile, and API security testing.
• Experience with SAST, DAST, WAF, and vulnerability assessment tools.
• Strong understanding of software supply chain security, SBOM, and third-party dependency management.
• Hands-on experience with CI/CD security and GitHub security controls.
• Proficiency in reading and debugging Java, JavaScript, and Python code.
• Experience with microservices architecture, threat modeling, and secure SDLC.
• Knowledge of AWS/GCP cloud security and GenAI/LLM application security.
• Preferred Certifications: OSCP / OSEP / OSWE.

Skills

AWS, AppSec, Application Security, CI / CD, DAST, GCP, GitHub, Jenkins, Penetration Testing, Product Security, SAST, SBOM, Threat Modelling, WAF