Application Security Engineer

GCS; Pune District; Sur place; INR 1 500 000 - 3 500 000; Plein temps

Résumé du poste

GCS in Pune, India seeks an experienced Application Security Engineer to strengthen the security of software products, platforms, APIs, and cloud services. The role embeds security throughout the software development lifecycle by partnering with product, architecture, engineering and platform teams to prevent, identify and remediate vulnerabilities early.

The successful candidate will combine strong software engineering capability with practical application security expertise, enabling

Qualifications

• Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity or related discipline.
• Several years of hands-on experience in software engineering, application security, product security or DevSecOps.
• Strong programming and scripting skills in at least one language used in modern software development.
• Experience with threat modelling, secure code review and security testing of web applications and APIs.
• Knowledge of OWASP Top 10 and software supply-chain risks.
• Experience integrating SAST, DAST, SCA and secrets scanning in CI/CD.
• Understanding of cloud-native architectures, containers, identity, encryption, logging and secure configuration.
• Ability to investigate findings and provide remediation guidance.
• Strong collaboration and coaching skills; ability to influence teams.
• Strong English communication.
• Experience working with global/distributed teams.
• Willingness to travel internationally when required.
• Ability to collaborate across time zones.

Responsabilités

• Embed application security requirements across requirements, architecture, design, development, testing, release and operations.
• Facilitate threat modelling and security design reviews for applications, APIs, integrations, cloud-native services and AI-enabled capabilities.
• Perform secure code reviews and targeted manual security testing, reproduce vulnerabilities and provide actionable remediation guidance.
• Engineer, integrate and continuously improve SAST, DAST, Software Composition Analysis (SCA), secrets detection and related security controls within CI/CD workflows.
• Define and maintain secure coding standards, reusable security patterns, reference implementations and developer guidance.
• Partner with Solution Architects, Security Architects and platform teams to address authentication, authorization, data protection, cryptography, logging and secure configuration.
• Triage technically complex application and dependency findings, validate exploitability and advise on severity, business impact and remediation options.
• Support development teams in correcting vulnerabilities and verify that fixes address root causes without introducing regressions.
• Coordinate application penetration tests and security assessments and translate findings into sustainable engineering improvements.
• Contribute application security evidence to product risk reviews, audits and regulatory readiness, including CRA expectations.
• Engineer security for desktop clients and hybrid desktop-to-cloud products, including secure update mechanisms, code signing, release integrity and artifact provenance.
• Implement SBOM generation and dependency governance workflows to support software component visibility, vulnerability response and regulatory readiness.
• Define and verify security requirements for engineering, calculation, configuration and specification workflows, protecting integrity of customer outcomes and project data.
• Support security incident analysis where application behaviour, source code, APIs or software dependencies are involved.
• Support coordinated vulnerability disclosure and product security response by validating reported issues and helping define sustainable corrective actions.
• Establish and coach a network of security champions, deliver practical training and improve developer self-service capabilities.
• Track AppSec coverage, recurring weakness patterns, remediation performance and the effectiveness of preventive controls.
• Collaborate with cybersecurity, architecture, DevSecOps, product and engineering teams across the wider organisation.

Connaissances

Software engineering

Application security

Threat modelling

CI/CD security

Coaching developers

Formation

Bachelor’s degree in CS/SE or related

Outils

Burp Suite

OWASP ZAP

Semgrep

SonarQube

Snyk

Checkmarx

GitHub Advanced Security

Description du poste

Reports to: Business Information Security Officer (BISO)

Role Summary

We are seeking a hands-on Application Security Engineer to strengthen the security of our client’s software products, platforms, APIs, cloud services and supporting development practices.

The role embeds security throughout the software development lifecycle by partnering with product, architecture, engineering and platform teams to prevent, identify and remediate vulnerabilities early.

The successful candidate will combine strong software engineering capability with practical application security expertise, enabling development teams through automation, reusable security patterns, coaching and risk-based guidance rather than acting solely as a late-stage approval gate.

The role supports a secure-by-design approach in which software development teams take ownership of customer security outcomes.

Responsibilities

• Embed application security requirements and activities across requirements, architecture, design, development, testing, release and operations.
• Facilitate threat modelling and security design reviews for applications, APIs, integrations, cloud-native services and AI-enabled capabilities.
• Perform secure code reviews and targeted manual security testing, reproduce vulnerabilities and provide actionable remediation guidance.
• Engineer, integrate and continuously improve SAST, DAST, Software Composition Analysis (SCA), secrets detection and related security controls within CI/CD workflows.
• Define and maintain secure coding standards, reusable security patterns, reference implementations and developer guidance.
• Partner with Solution Architects, Security Architects and platform teams to address authentication, authorization, data protection, cryptography, logging and secure configuration.
• Triage technically complex application and dependency findings, validate exploitability and advise on severity, business impact and remediation options.
• Support development teams in correcting vulnerabilities and verify that fixes address root causes without introducing regressions.
• Coordinate application penetration tests and security assessments and translate findings into sustainable engineering improvements.
• Contribute application security evidence to product risk reviews, audits and regulatory readiness, including expectations arising from the Cyber Resilience Act (CRA).
• Engineer security for desktop clients and hybrid desktop-to-cloud products, including secure update mechanisms, code signing, release integrity and artifact provenance.
• Implement SBOM generation and dependency governance workflows to support software component visibility, vulnerability response and regulatory readiness.
• Define and verify security requirements for engineering, calculation, configuration and specification workflows, protecting the integrity and correctness of customer outcomes and project data.
• Support security incident analysis where application behaviour, source code, APIs or software dependencies are involved.
• Support coordinated vulnerability disclosure and product security response by validating reported issues and helping define sustainable corrective actions.
• Establish and coach a network of security champions, deliver practical training and improve developer self-service capabilities.
• Track AppSec coverage, recurring weakness patterns, remediation performance and the effectiveness of preventive controls.
• Collaborate with cybersecurity, architecture, DevSecOps, product and engineering teams across the wider organisation.

Required Qualifications & Experience

• Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity or a related discipline, or equivalent practical experience.
• Several years of hands‑on experience in software engineering, application security, product security or DevSecOps.
• Strong programming and scripting skills in at least one language commonly used in modern software development.
• Demonstrated experience with threat modelling, secure code review and security testing of web applications and APIs.
• Practical knowledge of common vulnerability classes, including the OWASP Top 10, authentication and authorization flaws, injection, insecure design and software supply‑chain risks.
• Experience integrating and tuning SAST, DAST, SCA and secrets scanning tools within CI/CD pipelines.
• Understanding of cloud‑native architectures, containers, identity, encryption, logging and secure configuration.
• Ability to investigate findings, assess exploitability and communicate technically precise remediation guidance.
• Strong collaboration and coaching skills, with the ability to influence engineering teams without direct authority.
• Strong written and verbal communication skills in English.
• High level of integrity, ownership and commitment to protecting customers and software assets.
• Experience working with global and geographically distributed teams.
• Ability to travel internationally when required for key workshops, assessments or team collaboration.
• Ability to collaborate effectively across global time zones.

Preferred Skills

• Experience securing AWS‑based, SaaS, microservices, mobile or desktop applications.
• Knowledge of the NIST Secure Software Development Framework, secure‑by‑design principles and risk‑driven software assurance using OWASP ASVS and SAMM.
• Experience applying OWASP ASVS at an appropriate assurance level based on risk.
• Experience with tools such as Burp Suite, OWASP ZAP, Semgrep, SonarQube, Snyk, Checkmarx, GitHub Advanced Security or equivalent.
• Knowledge of API security, OAuth 2.0, OpenID Connect, JWT, secrets management and SBOM practices.
• Experience applying security principles to AI‑enabled applications and modern software supply chains.
• Relevant certifications such as CSSLP, GIAC GWEB/GWAPT, OSWE or equivalent are advantageous but not essential.
• Experience with specialist engineering or technical software environments would be advantageous.