AppSec / AI Security Engineer

5Exceptions Software Solutions Pvt Ltd; Indore District; Presencial; INR 2.500.000 - 4.000.000; Jornada completa

Descripción de la vacante

5Exceptions Software Solutions Pvt Ltd seeks an engineer to design and implement automated security scanning, code provenance, and governance for AI-generated code within our SDLC.

You will integrate security controls into CI/CD, minimize false positives, and enable secure usage of AI tools. 4+ years in application security and strong communication are essential for success in this role.

Formación

• Minimum 4+ years in Application Security or DevSecOps.
• Experience building security automation in pipelines.
• Familiar with AI-generated code security and governance.

Responsabilidades

• Design and implement automated security scanning in CI/CD.
• Develop code provenance tracking for AI-generated code.
• Create structured review workflows with scan results and provenance.
• Tune tools to reduce false positives and improve adoption.
• Lead independent security reviews of codebases for compliance.
• Contribute to AI governance standards for secure tooling.

Conocimientos

Security automation

CI/CD security

SAST

SCA

DAST

IaC security

Code provenance

AI governance

Cloud security (AWS)

Security reviews

Communication

Risk assessment

Educación

Security certifications (OSCP, GWAPT, CSSLP)

Herramientas

Semgrep

CodeQL

Snyk

Gitleaks

TruffleHog

Prowler

Trivy

Descripción del empleo

We're embedding security and AI governance into the core of our software development lifecycle. This role owns the design and implementation of automated security scanning, code provenance, and governance processes to ensure AI-generated code meets the highest security and compliance standards.

If you're a self-driven engineer who enjoys building security automation from the ground up and weaving security seamlessly into development pipelines, this role is for you.

Key Responsibilities

• Build and integrate security controls into CI/CD pipelines — including automated scanning for source code, dependencies, secrets, and Infrastructure as Code (IaC) — with enforcement gates on every merge.
• Design and implement code provenance tracking to capture AI-generated code, the AI models used, and reviewer approvals as part of the development pipeline.
• Develop structured code review workflows incorporating specifications, scan results, and code provenance.
• Optimize security scanning tools to reduce false positives and drive developer adoption.
• Investigate and manage security findings using established remediation and documentation processes.
• Contribute to AI governance standards, including secure usage of AI tools and governance of AI-generated code.
• Conduct independent security reviews of internally developed, third-party, and vendor-supplied code to ensure compliance with security standards.

Required Skills & Experience

• Strong hands-on experience in Application Security, with proven expertise securing CI/CD pipelines.
• Experience implementing automated security scanning and enforcement — not just operating existing tools.
• Strong knowledge of SAST, SCA, secret scanning, DAST, and IaC security scanning.
• Strong understanding of cloud infrastructure, with hands-on or working knowledge of AWS and Azure, is preferred.
• Ability to design, build, and own security automation and governance solutions from the ground up.
• Strong judgment in balancing security with developer productivity by minimizing unnecessary alerts.
• Excellent communication skills, with the ability to explain security risks in clear, business-friendly language.
• Strong analytical mindset and ability to independently assess security risk across internal and external codebases.

Preferred Qualifications

• ~4+ years of experience in Application Security, Security Engineering, DevSecOps, or a related field.
• Experience with AI-generated code security, LLM security risks, prompt injection, code provenance, or AI governance.
• Hands-on experience with tools such as Semgrep, CodeQL, Snyk, Gitleaks, TruffleHog, Prowler, Trivy, or similar.
• AWS certification (Solutions Architect Associate preferred), or willingness to obtain one within 90 days.
• Security certifications such as OSCP, GWAPT, CSSLP, or equivalent.
• Experience writing custom detection rules or security policies (e.g., custom Semgrep rules).