Principal Engineer (security)

Sage City; Bengaluru; Híbrido; INR 4 000 000 - 6 000 000; Tempo integral

Resumo da oferta

Sage City is seeking a Principal Security Engineer in Bangalore. You will drive security across the SDLC and post-launch operations, fostering a strong security culture and rapid remediation of vulnerabilities. This hybrid role requires 10+ years' experience and deep cloud and secure coding expertise.

You will partner with product and engineering teams, guide AI security considerations, and shape security observability and incident response capabilities across fintech-style deployments.

Qualificações

• Extensive experience embedding security across the SDLC.
• Experience securing public cloud-based SaaS apps.
• Hands-on with OAuth2/OIDC/JWT in multi-issuer setups.
• Proficiency in secure coding, threat modeling and risk mapping.
• Familiarity with compliance standards (SOC, ISO27001, PCI).

Responsabilidades

• Collaborate with engineers to raise security capability in teams.
• Drive improvements in the secure SDLC and modern DevSecOps.
• Serve as security contact for Product Delivery on major programs.
• Assess applications for weaknesses and plan fixes.
• Support security compliance for assigned products.
• Identify tool/vendor needs and lead evaluations.
• Improve processes, standards, and security designs.
• Mentor junior team members and provide leadership.
• Contribute to industry bodies and open-source projects.

Conhecimentos

Security in SDLC

OAuth2/OIDC/JWT

OWASP Top 10

Cloud security

DevSecOps

AI security

Compliance frameworks

Security observability

Incident response

Threat modeling

Formação académica

Bachelor's degree in a relevant field

CISSP / CSSLP / AWS Security Specialty

Security certifications or equivalent

Ferramentas

AWS

Azure

Kubernetes

IAM / IAM policies

Infrastructure as Code (IaC)

Descrição da oferta de emprego

Job Description About the RoleAs a Principal Security Engineer at Sage, you will drive improvements spanning the whole SDLC and post-launch operations. You will work with all engineers to develop a strong security culture and capability to ensure that new product/system releases are secure, and that vulnerabilities discovered are quickly and effectively addressed.We are looking for someone with a relevant degree and 10+ years' experience.Location: Bangalore, India. This is a hybrid role, three days per week in the office.Required Skills Significant experience in implementing security in the software development lifecycle Experience in implementing security in public cloud-based SaaS applications OAuth2 / OIDC / JWT validation (RS256, JWKS), token propagation, and multi-issuer auth. Secure coding against the OWASP Top 10; multi-tenant isolation and row-level security. Proficiency in English, written and verbal Experience of working with geographically dispersed teams Experience working in an agile, DevOps/DevSecOps environment Experience using AI tools to improve security operations, such as AI-assisted code scanning, vulnerability triage, or threat modeling. Awareness of AI/ML-specific security and privacy risks (prompt injection, data leakage, model governance) and the ability to fold them into existing secure development lifecycle and compliance practices Comfortable partnering with product and engineering teams to assess and mitigate security and privacy risks specific to AI-driven capabilities. Experience of formal compliance frameworks (e.g. SOC, ISO27001, PCI or similar) Relevant professional security qualifications such as CISSP, CSSLP, AWS Security Specialty or similar. Ability to translate technical security risks into clear business implications. Experience with security observability, detection engineering, and incident response.Nice to Have Hands-on experience with AWS or Azure, Kubernetes, container security, and infrastructure as code. Experience securing large-scale fintech applications, payment systems, or financial integrations. Experience designing zero-trust access controls, secure API gateways, and identity and access management solutions. Participation in web security CTFs or bug bounty programs, particularly those involving fintech, cloud, or infrastructure.#LI-RTKey Responsibilities Responsibilities Working with all engineers to develop a strong security capability in teams and improving the effectiveness of the overall Security Champion program Driving continual improvement in the secure software development lifecycle and supporting our drive to a modern DevSecOps approach Acts as the main point of contact on security issues for Product Delivery teams on major strategic groups of products/systems Assessing the application to identify security weaknesses and creating improvement plans where required Supporting security compliance as it relates to assigned product Identifies the need for new tools and vendors and leads their evaluation Drives significant improvement in key processes/standards and designs and implements new processes/standards Contributes to performance evaluation and technical mentoring of junior team members Provides technical security leadership for significant projects or workstreams Active contributor to relevant industry bodies, conferences, open-source projects etc.#LI-RT