Senior Application Security Engineer

<h3>Accountabilities</h3><li>Lead threat modeling for critical application areas, including authentication and session management, privilege escalation, integrations, tenant isolation, cryptography, and secrets management.</li><li>Define security requirements early in the architecture and development process, working directly with engineering teams to address risks before release.</li><li>Assess security risks and provide clear recommendations to product and engineering leadership to support informed release and risk-acceptance decisions.</li><li>Contribute directly to product repositories by reviewing and implementing security fixes, dependency updates, and code-level remediation in collaboration with development teams.</li><li>Own and improve static application security testing, dynamic testing, dependency scanning, and related security tooling across product lines.</li><li>Tune security tools to improve signal quality, reduce unnecessary disruption, and ensure findings reach the teams responsible for remediation.</li><li>Promote secure coding practices across large C#/.NET and Java codebases through reusable patterns, libraries, reference implementations, and targeted code reviews.</li><li>Establish appropriate security review practices for AI-assisted software development, including assessment of AI-generated code and automated remediation workflows.</li><li>Lead product vulnerability response from intake through triage, remediation, coordinated disclosure, CVE management, and customer-facing security advisories.</li><li>Analyze penetration-testing and bug-bounty findings to identify recurring weaknesses and implement systemic controls that prevent similar vulnerabilities.</li><li>Own software composition analysis and SBOM generation, including software provenance and licensing information required by customers and internal stakeholders.</li><li>Maintain security evidence that can support customer questionnaires, security reviews, certifications, and other assurance activities.</li><li>Collaborate with engineering, product, legal, and other stakeholders to continuously strengthen application security across the product portfolio.</li><h2>Requirements</h2><li>6+ years of experience in software engineering or security, including at least 3 years focused on application or product security; equivalent professional depth may be considered.</li><li>Demonstrated application security experience with products that customers deploy and operate within their own environments.</li><li>Strong production-level programming skills in<strong>C# and .NET</strong>, with sufficient experience in<strong>Java</strong>to review and contribute to Java-based applications.</li><li>Recent hands-on experience with AI-assisted development or AI-enabled security tooling, ideally within the last six months.</li><li>Strong understanding of threat modeling and the ability to collaborate with engineering teams during the design stage.</li><li>Experience with static analysis, dynamic application testing, software composition analysis, dependency scanning, and security tooling optimization.</li><li>Knowledge of identity and authentication technologies and protocols such as<strong>OAuth, OIDC, SAML, and SCIM</strong>.</li><li>Experience with coordinated vulnerability disclosure, vulnerability triage, CVE processes, and customer-facing security advisories.</li><li>Strong secure code review capabilities across web applications and APIs.</li><li>Understanding of software supply-chain security, SBOM standards, dependency management, and license compliance.</li><li>Experience with cryptographic reviews, security champion programs, PCI DSS, FedRAMP, or similar security frameworks is advantageous.</li><li>Ability to communicate complex security risks clearly to technical and non-technical stakeholders and influence senior engineers effectively.</li><li>Strong analytical and problem-solving skills, with the judgment to prioritize security risks according to business and technical impact.</li><li>Ability to work independently across multiple product teams while collaborating effectively within a globally distributed organization.</li><li>Prior experience as a product or software engineer is a plus.</li><h2>Benefits</h2><li>Remote working opportunity based in India.</li><li>Senior-level ownership across multiple product lines and application security initiatives.</li><li>Direct collaboration with engineering and product leadership.</li><li>Opportunity to influence security architecture, secure development practices, and vulnerability management at scale.</li><li>Hands-on exposure to modern application security, AI-assisted development, software supply-chain security, and cloud-hosted products.</li><li>Globally distributed and collaborative working environment.</li><li>Opportunities for professional development, learning, and career growth.</li><li>Employee-focused health and wellbeing programs.</li><li>Inclusive and equal-opportunity workplace committed to diversity and respect.</li>