Application Security Engineer
New
S
Sun KingApplication security
Source API remote eligibility restrictions: IndiaFull-TimeJunior
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Experience
- At least 2 years of hands-on application security experience
- Required Skills
- PythonKubernetes
Requirements
- Bachelor's degree in Computer Science, Cyber Security, or a related field.
- At least 2 years of hands-on application security experience.
- Good understanding of OWASP Top 10, API Security Top 10, and authorization flaws including BOLA, BFLA, and privilege escalation.
- Experience manually testing web applications, APIs, and Android applications, and conducting manual code reviews beyond running tools.
- Familiarity with OAuth2, OIDC, JWT, and common misconfigurations in providers such as Keycloak and Firebase.
- Experience integrating and tuning SAST/DAST tools in CI/CD pipelines; SCA/IAST experience is optional.
- Exposure to cloud-native security, including Kubernetes, containers, service mesh, and IAM concepts across at least one major cloud provider.
- Ability to script or automate with tools such as Python or Bash.
- Familiarity with AI/LLM security risks, such as OWASP LLM Top 10.
- Practical experience implementing AI safety controls in production or assessing insecure use of third-party AI APIs.
Responsibilities
- Own application security for assigned business functions through threat modeling, architecture reviews, penetration testing, secure coding programs, and vulnerability management.
- Perform manual penetration testing and vulnerability assessments on web applications, APIs, and Android applications.
- Review security for AI-native products, models, pipelines, and inference services.
- Onboard applications into the SSDLC program and serve as the application security point of contact.
- Own product-layer security incident response, define remediation plans, and track fixes through closure.
- Integrate and tune SAST, DAST, IAST, and SCA tools in CI/CD, create custom rules where needed, and triage false positives.
- Review and harden cloud infrastructure, including Kubernetes RBAC, pod security, network policies, Istio service mesh, Keycloak/OIDC configurations, and IAM.
- Communicate vulnerabilities and risk to developers, product managers, and leadership.
- Conduct application security training for engineers and product managers.
View Full Description & ApplyYou'll be redirected to the employer's site
