Application Security Engineer

Ola; Bengaluru; On-site; INR 1,200,000 - 2,000,000; Full time

Job summary

A leading mobility solutions company in Bengaluru seeks an Application Security Engineer to enhance security across products and services. The role involves embedding security practices within development processes and ensuring compliance with industry standards like ISO 27001 and GDPR. Ideal candidates have a strong background in application security engineering and experience with web, mobile, and cloud security.

Qualifications

• Strong understanding of security principles and methodologies.
• Proficiency in application security engineering.
• Expertise in web, mobile, and cloud security.

Responsibilities

• Embed security in all products and services.
• Perform threat modeling and security reviews.
• Develop and implement security policies and standards.

Skills

Security principles

Application security engineering

Incident response

Web security

Mobile security

Cloud security

Risk assessment

ISO compliance

Communication skills

Tools

OWASP

SANS frameworks

Job description

Overview

Job Title: Application Security Engineer

Job Summary:

A Security Engineer will be responsible for ensuring the security and privacy of the company’s products and services. This role will be vital in shaping the company’s security strategy by working closely with development teams to identify, evaluate, and mitigate potential security risks and ensuring that all products are designed, built, and deployed with security as a critical consideration.

Roles and Responsibilities

• Embed security in all products and services, including architecture, development, deployment, and maintenance, through the SSDLC program.
• Perform threat modeling, security reviews, code assessments, penetration testing, and overall application security evaluations.
• Develop and implement security policies, standards, and guidelines to secure product development processes.
• Identify and mitigate security risks across the product life cycle with practical solutions.
• Continuously enhance the organization’s security posture through technical improvements and process optimization.
• Assist in incident response and support vulnerability remediation efforts with technical expertise.
• Stay informed on emerging security threats and technologies, integrating improvements into the security strategy.
• Drive the adoption of shift-left security practices, ensuring security is considered early in development.
• Collaborate with DevOps and IT teams to integrate security into the CI/CD pipeline and drive security automation initiatives such as SAST, DAST, and IAST.
• Measure and improve security maturity using different frameworks like the DevSecOps Maturity Model.
• Ensure compliance with industry standards and regulations such as ISO 27001, GDPR, and PCI DSS.
• Promote security awareness across development teams and establish secure coding practices through continuous education.

Experience & Skills

• Strong understanding of security principles and methodologies, with experience securing systems at scale.
• Proficiency in application security engineering, vulnerability assessments, and incident response.
• Expertise in web, mobile, and cloud security and familiarity with tools like OWASP and SANS frameworks.
• Mobile Application Testing, API Security Testing, Web Application Testing, Cloud Security (AWS, GCP, OpenStack etc)
• Strong problem-solving skills with the ability to address complex security issues.
• Excellent communication and collaboration skills, with experience working across development and operations teams.
• Expertise in ISO/IEC 27001, ISO 27017, ISO 27018, SOC 2, and PCI DSS is highly desirable.