Arrive - Senior Product Security Engineer

Arrive; Bengaluru Urban; On-site; INR 2,400,000 - 4,200,000; Full time

Job summary

Arrive is seeking a Product Security Engineer to strengthen security of applications and cloud-native platforms. The role focuses on proactive security testing, vulnerability management, secure SDLC integration, and collaboration with engineering teams.

You will conduct manual and automated testing of web apps and APIs, perform threat modeling, and provide remediation guidance while working with DevOps, Cloud, and Engineering teams to improve overall security posture.

Qualifications

• 6–9 years of experience in Application Security or Offensive Security.
• Hands-on experience conducting web and API penetration testing.
• Strong knowledge of OWASP Top 10 and common attack vectors.
• Experience using security tools such as Burp Suite, OWASP ZAP, Nmap, Snyk and Checkmarx.
• Experience working with cloud platforms (AWS/Azure/GCP).
• Familiarity with container security and modern DevOps environments.
• Experience reviewing code for security issues.

Responsibilities

• Conduct manual and automated testing of web apps and APIs for security gaps.
• Identify vulnerabilities aligned with OWASP Top 10 and API Top 10.
• Perform threat modeling for new features and services.
• Review secure coding practices and provide remediation guidance.
• Collaborate with DevOps, Cloud, and Engineering teams and report findings.

Skills

Penetration testing

OWASP Top 10

Cloud security

Scripting (Python/Bash)

Container security

Code security review

Tools

Burp Suite

OWASP ZAP

Nmap

Snyk

Checkmarx

Job description

About Arrive

Arrive, including brands like EasyPark, Flowbird, RingGo, ParkMobile and Parkopedia, is a leading global mobility platform. Present in over 90 countries and 20,000 cities, the company helps people and decision-makers make smarter decisions about urban mobility and ease the experience of travel worldwide.

About Arrive

Arrive, including brands like EasyPark, Flowbird, RingGo, ParkMobile and Parkopedia, is a leading global mobility platform. Present in over 90 countries and 20,000 cities, the company helps people and decision-makers make smarter decisions about urban mobility and ease the experience of travel worldwide.

Role Overview

We are seeking a Product Security Engineer to strengthen the security posture of our applications and cloud-native platforms. This role focuses on proactive application security testing, vulnerability management, secure SDLC integration, and collaboration with engineering teams.

Key Responsibilities

Application & API Security

• Conduct manual and automated penetration testing of web applications and APIs.
• Identify and validate vulnerabilities aligned with OWASP Top 10 and API Security Top 10.
• Perform threat modeling for new features and services.
• Conduct secure code reviews (static analysis) and recommend remediation.
• Validate findings from SAST, DAST, and dependency scanning tools.
• Provide remediation guidance and conduct fix verification testing.
• Participate in design reviews and architecture discussions from a security perspective.

Cloud & Infrastructure Security

• Assess AWS/Azure/GCP configurations for common misconfigurations.
• Review IAM policies, storage access controls, and container security posture.
• Validate findings from CSPM/CNAPP tools.
• Support cloud-native application security assessments.

Vulnerability Management

• Prioritize vulnerabilities using CVSS and business impact context.
• Track remediation SLAs and support risk acceptance decisions.
• Provide actionable recommendations to development teams.

Security Testing & Automation

• Develop scripts and tooling (Python/Bash) to automate testing workflows.
• Improve security testing playbooks and documentation.
• Contribute to enhancing detection and monitoring coverage.

Collaboration & Reporting

• Prepare high-quality technical reports with clear risk articulation.
• Translate technical findings into business-impact language.
• Work cross-functionally with DevOps, Cloud, and Engineering teams.

Required Skills

• 6 - 9 years of experience in Application Security, Product Security, or Offensive Security.
• Hands-on experience conducting web and API penetration testing.
• Strong understanding of OWASP Top 10 and common attack vectors.
• Experience using tools such as Burp Suite, OWASP ZAP, Nmap, Snyk, Checkmarks, etc.
• Experience working with cloud platforms (AWS/Azure/GCP).
• Familiarity with container security and modern DevOps environments.
• Experience reviewing code for security issues.
• Strong understanding of HTTP, authentication mechanisms, and networking fundamentals.
• Basic scripting experience (Python, Bash, or similar).

Preferred Experience

• Experience in SaaS, fintech, or product-based organizations.
• Exposure to Kubernetes and container security testing.
• Familiarity with bug bounty or responsible disclosure programs.
• Experience implementing DevSecOps practices.
• Certifications such as CEH, Security+, eJPT, OSCP (nice to have).