Lead Application Security Engineer

InMobi Advertising; Bengaluru; On-site; INR 1,500,000 - 2,500,000; Full time

Job summary

A leading advertising technology firm in Bengaluru is looking for an Associate in application security. You will conduct vulnerability assessments, automate tasks in CI/CD, and collaborate with product teams to build secure solutions. Ideal candidates should have at least 6 years of experience in application security and proficiency with tools like BurpSuite and Checkmarx. This full-time role offers opportunities to grow in a cloud-native DevOps environment.

Qualifications

• 6 years of experience in application security, penetration testing, and DevSecOps.
• 2-3 years in building and managing security gating.
• Excellent skills with application security testing tools.

Responsibilities

• Conduct vulnerability assessments and penetration testing.
• Automate technical tasks in CI/CD.
• Develop solution architecture and blueprints.

Skills

Application security

Penetration testing

DevSecOps

BurpSuite

Python

Kubernetes

Tools

Checkmarx

OWASP ZAP

SQLMap

Kali

Job description

InMobi is the leading provider of content, monetization, and marketing technologies that fuel growth for industries around the world. Our end-to-end advertising software platform, connected content, and commerce experiences activate audiences, drive real connections, and diversify revenue for businesses everywhere. InMobi Advertising is an end-to-end advertising platform that helps advertisers drive real connections with consumers. We drive customer growth by helping businesses understand, engage, and acquire consumers effectively through data-driven media solutions.

What does the team do?

Opportunity is part of the evolving cyber security group which is laser-focused on setting up industry benchmarks in managing & guarding against digital risks in a “Cloud Native - DevOps Only” environment. It is a lean-mean-special action group where every cyber sentinel gets an opportunity to work across domains, has the independence to challenge the status quo & evolve cyber practices to the next level of maturity. Our core competencies revolve around “Product & Platform security”, “Cloud Native Risk Management” and “Detection & Response”.

What you will be doing?

• Conducted vulnerability assessments, penetration testing, and source code review.
• Automate Technical tasks in CI/CD through the use of APIs or tools.
• Perform application source code security reviews for APIs, middleware, and frontends in Java, Python, Node.js, etc.
• Exploit security flaws and vulnerabilities with attack simulations on multiple application platforms like Web, iOS, Android, and cloud platforms.
• Perform SAST & DAST and improve SDLC.
• Develop solution architecture and blueprints based on business technology and security objectives.
• Research and maintain secure coding guidelines.
• Perform Security Architecture and Low-Level Application Security Design review involving: Data Protection, Authentication and Authorizations, Web Application Security, and Network Security.
• Collaborate with product teams to build secure products and achieve the cybersecurity objectives of InMobi.
• Maintain an active understanding of industry practices for secure software development and incident response.

What is expected of you?

• Zealous to unlearn & re-learn cybersecurity practices in a “Cloud Native- DevOps Only” environment.
• 6 years of experience in application security, penetration testing, and DevSecOps.
• 2-3 years of experience in building and managing security gating in Checkmarx or an equivalent tool.
• 2-3 years of experience in manual security code review
• Standardize & maximize automation in the CI/CD pipeline.
• Excellent skills with application security testing tools such as BurpSuite, OWASP ZAP, SQLMap, Kali, etc.
• Experience with scripting languages such as Python, bash, PowerShell, etc.
• Experience in building and deploying open-source security software in production and making it scalable.
• Knowledge of Kubernetes and Docker containers.
• Knowledge of OWASP Top 10 and SANS Top 25.
• Red Teamer with proven skills in exploitation.
• Strong understanding of security fundamentals and general security technologies.
• Excellent oral and written communication skills and a good team player.
• Bug bounties, responsible disclosure awards & Hall of Fame are strongly preferred.
• Certifications such as GWAPT, Offensive Security Certified Professional (OSCP), OSCE, or GIAC Penetration Testing (GPEN) are strongly preferred.

Seniority level

Associate

Employment type

Full-time

Job function

• Information Technology

Industries

• Advertising Services