Application Security Engineer

5Exceptions Software Solutions Pvt Ltd; Indore District; On-site; INR 1,500,000 - 2,200,000; Full time

Job summary

5Exceptions Software Solutions Pvt Ltd in Indore (Work from Office) is seeking an AppSec / AI Security Engineer with 4 to 8 years of experience to design and implement automated security scanning, code provenance, and governance across the software development lifecycle.

You will build security controls into CI/CD, enforce gates on merges, and contribute to AI governance standards, while balancing security with developer productivity.

Qualifications

• Strong hands-on experience in Application Security and securing CI/CD pipelines.
• Experience implementing automated security scanning and enforcement, not just using tools.
• Knowledge of SAST, SCA, secret scanning, DAST, and IaC security scanning.
• Hands-on or working knowledge of AWS and Azure preferred.
• Ability to design, build, and own security automation and governance solutions.

Responsibilities

• Build and integrate security controls into CI/CD pipelines with automated scanning and gates.
• Design and implement code provenance tracking for AI-generated code and reviewers.
• Develop structured code review workflows with specifications, scan results, and provenance.
• Optimize security scanning tools to reduce false positives and improve adoption.
• Investigate and manage security findings using remediation processes.
• Contribute to AI governance standards for secure AI tooling and governance of AI-generated code.
• Conduct independent security reviews of internal, third-party, and vendor code for compliance.

Skills

Application Security

CI/CD pipelines

SAST

SCA

DAST

IaC security

AWS

Azure

Security automation

Governance

Communication

Analytical mindset

Tools

Semgrep

CodeQL

Snyk

Gitleaks

TruffleHog

Prowler

Trivy

Job description

We're embedding security and AI governance into the core of our software development lifecycle. This role owns the design and implementation of automated security scanning, code provenance, and governance processes to ensure AI-generated code meets the highest security and compliance standards.

If you're a self-driven engineer who enjoys building security automation from the ground up and weaving security seamlessly into development pipelines, this role is for you.

About The Role

Job Title: AppSec / AI Security Engineer (4 to 8 years)

Employment Type: Full-time/ Permanent

Location: Indore (Work from Office)

Key Responsibilities

• Build and integrate security controls into CI/CD pipelines including automated scanning for source code, dependencies, secrets, and Infrastructure as Code (IaC) with enforcement gates on every merge.
• Design and implement code provenance tracking to capture AI-generated code, the AI models used, and reviewer approvals as part of the development pipeline.
• Develop structured code review workflows incorporating specifications, scan results, and code provenance.
• Optimize security scanning tools to reduce false positives and drive developer adoption.
• Investigate and manage security findings using established remediation and documentation processes.
• Contribute to AI governance standards, including secure usage of AI tools and governance of AI-generated code.
• Conduct independent security reviews of internally developed, third-party, and vendor-supplied code to ensure compliance with security standards.

Required Skills Experience

• Strong hands-on experience in Application Security, with proven expertise securing CI/CD pipelines.
• Experience implementing automated security scanning and enforcement not just operating existing tools.
• Strong knowledge of SAST, SCA, secret scanning, DAST, and IaC security scanning.
• Strong understanding of cloud infrastructure, with hands-on or working knowledge of AWS and Azure, is preferred.
• Ability to design, build, and own security automation and governance solutions from the ground up.
• Strong judgment in balancing security with developer productivity by minimizing unnecessary alerts.
• Excellent communication skills, with the ability to explain security risks in clear, business-friendly language.
• Strong analytical mindset and ability to independently assess security risk across internal and external codebases.

Preferred Qualifications

• 4 to 8 years of experience in Application Security, Security Engineering, DevSecOps, or a related field.
• Experience with AI-generated code security, LLM security risks, prompt injection, code provenance, or AI governance.
• Hands-on experience with tools such as Semgrep, CodeQL, Snyk, Gitleaks, TruffleHog, Prowler, Trivy, or similar.
• AWS certification (Solutions Architect Associate preferred), or willingness to obtain one within 90 days.
• Security certifications such as OSCP, GWAPT, CSSLP, or equivalent.
• Experience writing custom detection rules or security policies (e.g., custom Semgrep rules).