Principal Engineer (security)

Sage; Bengaluru; Hybrid; INR 3,500,000 - 5,500,000; Full time

Job summary

Sage in Bengaluru, India seeks a Principal Security Engineer to drive security across the full software lifecycle and post-launch operations. You will collaborate with all engineers to foster a strong security culture, address vulnerabilities quickly, and ensure multi-tenant, cloud-based SaaS security.

This hybrid role requires three days in the office weekly, with senior responsibilities in DevSecOps and risk management.

Qualifications

• Significant experience implementing security in the software development lifecycle.
• Experience securing cloud-based SaaS applications.
• Proficient in OAuth2/OIDC/JWT validation and token propagation.
• Strong secure coding practices oriented to OWASP Top 10 and multi-tenant security.
• Excellent written and verbal English; experience leading dispersed teams.
• Experience in agile, DevOps/DevSecOps environments.
• Awareness of AI/ML security risks and governance.

Responsibilities

• Work with all engineers to build security capability and strengthen the Security Champion program.
• Improve secure SDLC and advance our DevSecOps initiatives.
• Serve as the main security contact for Product Delivery teams on key product groups.
• Assess applications to identify weaknesses and create improvement plans.
• Support security compliance for assigned products.
• Identify and evaluate new security tools and vendors.
• Improve key processes and design new security standards.
• Mentor junior team members and contribute to performance evaluations.
• Provide technical security leadership for major projects.
• Contribute to industry bodies, conferences, and open-source projects.

Skills

Secure SDLC

Cloud security

OAuth2/OIDC/JWT

OWASP Top 10

DevSecOps

AI security

Compliance frameworks

Security leadership

Threat modeling

Incident response

Security observability

Stakeholder communication

Education

Relevant degree

Job description

As a Principal Security Engineer at Sage, you will drive improvements spanning the whole SDLC and post-launch operations. You will work with all engineers to develop a strong security culture and capability to ensure that new product/system releases are secure, and that vulnerabilities discovered are quickly and effectively addressed.

We are looking for someone with a relevant degree and 10+ years' experience.

Location: Bangalore, India. This is a hybrid role, three days per week in the office.

Required Skills

• Significant experience in implementing security in the software development lifecycle
• Experience in implementing security in public cloud-based SaaS applications
• OAuth2 / OIDC / JWT validation (RS256, JWKS), token propagation, and multi-issuer auth.
• Secure coding against the OWASP Top 10; multi-tenant isolation and row-level security.
• Proficiency in English, written and verbal
• Experience of working with geographically dispersed teams
• Experience working in an agile, DevOps/DevSecOps environment
• Experience using AI tools to improve security operations, such as AI-assisted code scanning, vulnerability triage, or threat modeling.
• Awareness of AI/ML-specific security and privacy risks (prompt injection, data leakage, model governance) and the ability to fold them into existing secure development lifecycle and compliance practices
• Comfortable partnering with product and engineering teams to assess and mitigate security and privacy risks specific to AI-driven capabilities.
• Experience of formal compliance frameworks (e.g. SOC, ISO27001, PCI or similar)
• Relevant professional security qualifications such as CISSP, CSSLP, AWS Security Specialty or similar.
• Ability to translate technical security risks into clear business implications.
• Experience with security observability, detection engineering, and incident response.

Nice to Have

• Hands-on experience with AWS or Azure, Kubernetes, container security, and infrastructure as code.
• Experience securing large-scale fintech applications, payment systems, or financial integrations.
• Experience designing zero-trust access controls, secure API gateways, and identity and access management solutions.
• Participation in web security CTFs or bug bounty programs, particularly those involving fintech, cloud, or infrastructure.

Key Responsibilities

• Working with all engineers to develop a strong security capability in teams and improving the effectiveness of the overall Security Champion program
• Driving continual improvement in the secure software development lifecycle and supporting our drive to a modern DevSecOps approach
• Acts as the main point of contact on security issues for Product Delivery teams on major strategic groups of products/systems
• Assessing the application to identify security weaknesses and creating improvement plans where required
• Supporting security compliance as it relates to assigned product
• Identifies the need for new tools and vendors and leads their evaluation
• Drives significant improvement in key processes/standards and designs and implements new processes/standards
• Contributes to performance evaluation and technical mentoring of junior team members
• Provides technical security leadership for significant projects or workstreams
• Active contributor to relevant industry bodies, conferences, open-source projects etc.