About the role
We are looking for an experienced Application Security Engineer III to strengthen product security across web, mobile, API, and cloud-native applications. The ideal candidate should have strong expertise in penetration testing, vulnerability research, software supply chain security, and secure SDLC, along with exposure to securing GenAI-based applications.
Responsibilities:
- Lead software supply chain security initiatives, including SBOM management and third-party dependency security.
- Integrate security controls and guardrails into CI/CD pipelines using Jenkins/GitHub Actions.
- Perform vulnerability reachability analysis by reproducing and validating third-party library vulnerabilities.
- Manage GitHub security posture, including secret scanning, branch protection, and repository security.
- Conduct advanced web, mobile (Android/iOS), and API penetration testing.
- Identify complex business logic vulnerabilities across microservices-based applications.
- Perform threat modeling, security architecture reviews, and secure SDLC assessments.
- Secure GenAI/LLM-based applications against emerging security threats.
- Conduct security reviews, code reviews, and risk assessments while mentoring developers on secure coding practices.
Requirements:
- 6-10 years of experience in application security/product security/penetration testing.
- Strong hands-on expertise in web, mobile, and API security testing.
- Experience with SAST, DAST, WAF, and vulnerability assessment tools.
- Strong understanding of software supply chain security, SBOM, and third-party dependency management.
- Hands-on experience with CI/CD security and GitHub security controls.
- Proficiency in reading and debugging Java, JavaScript, and Python code.
- Experience with microservices architecture, threat modeling, and secure SDLC.
- Knowledge of AWS/GCP cloud security and GenAI/LLM application security.
- Preferred Certifications: OSCP / OSEP / OSWE.