Application Security Engineer

BMC Software; Pune City; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

BMC Software is seeking an Application Security Engineer to lead security testing for enterprise products on mainframe environments. The ideal candidate will have extensive experience in penetration testing, focusing on identifying vulnerabilities and guiding secure architecture. Join a diverse team committed to innovation and excellence.

Qualifications

• 5+ years of experience in penetration testing, especially with mainframe systems.
• Deep knowledge of mainframe communication protocols and security.
• Experience in leading technical teams and presenting findings.

Responsibilities

• Conduct penetration testing and red teaming on mainframe environments.
• Identify security risks and guide product teams in mitigation.
• Author technical reports and present to stakeholders.

Skills

Penetration Testing

Offensive Security

Communication

Leadership

Scripting (Python, REXX, Bash)

Tools

Nmap

Burp Suite

Wireshark

REXX

ISPF panels

NetView

Job description

Join to apply for the Application Security Engineer role at BMC Software

1 day ago Be among the first 25 applicants

Get AI-powered advice on this job and more exclusive features.

Description and Requirements

"At BMC trust is not just a word - it's a way of life!"

We are an award-winning, equal opportunity, culturally diverse, fun place to be. Giving back to the community drives us to be better every single day. Our work environment allows you to balance your priorities, because we know you will bring your best every day. We will champion your wins and shout them from the rooftops. Your peers will inspire, drive, support you, and make you laugh out loud!

We help our customers free up time and space to become an Autonomous Digital Enterprise that conquers the opportunities ahead - and are relentless in the pursuit of innovation!

The IZOT product line includes BMC’s Intelligent Z Optimization & Transformation products, which help the world’s largest companies to monitor and manage their mainframe systems. The modernization of mainframe is the beating heart of our product line, and we achieve this goal by developing products that improve the developer experience, the mainframe integration, the speed of application development, the quality of the code and the applications’ security, while reducing operational costs and risks. We acquired several companies along the way, and we continue to grow, innovate, and perfect our solutions on an ongoing basis.

We are looking for an Application Security Engineer to take ownership of security testing for enterprise products deployed on mainframe environments. You will assess application-layer security risks, identify vulnerabilities in product implementations, and lead secure architecture reviews. The ideal candidate brings deep offensive security skills along with familiarity in testing applications running on or integrated with IBM mainframe systems.

Primary Roles And Responsibilities

• Conduct penetration testing and red teaming exercises targeting mainframe environments and the surrounding application ecosystem.
• Perform code-assisted and black-box penetration testing against enterprise applications/systems interacting with RACF, DB2, CICS, MQ, and related subsystems.
• Identify risks in authentication, authorization, data handling, and communications within mainframe-integrated products.
• Create threat models and guide product teams in mitigating high-impact vulnerabilities early in the SDLC.
• Drive remediation efforts through hands-on collaboration and secure design guidance.
• Author technical reports and deliver executive summaries tailored to various audiences.
• Stay current on vulnerabilities, exploits, and testing techniques relevant to legacy enterprise technologies and mainframe ecosystems.
• Assess common integration patterns (SOA, REST/JSON, MQ) for security risks.

Skills & Experience

• 5+ years of experience in penetration testing, with a specialization in systems/applications integrating with mainframe environments.
• Deep knowledge of mainframe communication protocols and security mechanisms.
• Experience conducting red team assessments or advanced threat emulation on mainframe systems.
• Proficient in tools such as: Mainframe utilities: REXX, ISPF panels, NetView; Security tools: Nmap, Burp Suite, Wireshark, custom scripts; Strong scripting skills (Python, REXX, Bash).
• Strong communication and leadership skills, with a proven ability to lead technical teams or projects.
• Experience producing reports and presenting findings to senior stakeholders.
• Exposure to hybrid environments (mainframe to cloud integrations, modernization efforts).
• Familiarity with modern enterprise integration methods (REST, SOAP, MQ, FTP).

Nice to Have Skills

• Industry certifications such as OSCP, OSCE, CRTP, GIAC GPEN, GXPN, or CISSP.
• Background in regulated industries like banking, insurance, or government.
• Knowledge of COBOL, PL/I, or other mainframe-centric languages.
• Experience with compliance standards like PCI-DSS, NIST, or SOX.

Additional Information

Our culture is built around its people. We have 6000+ brilliant minds working together globally. We encourage diversity and welcome applicants from all backgrounds.

If you're excited about BMC and this role but unsure if you meet all qualifications, we still encourage you to apply! We value diverse experiences and ideas.

BMC is an equal opportunity employer. For accommodations during the application process, please visit our accommodation request page.

Note: BMC does not request payment for employment opportunities. The salary midpoint for this role is 2,117,800 INR, with actual compensation depending on various factors.

This role is eligible for candidates who have taken a career break and wish to re-enter the workforce. Learn more at https://bmcrecruit.avature.net/returnship.