Product Security Engineer

Quvia; Chennai District; On-site; INR 2,000,000 - 4,000,000; Full time

Job summary

Quvia seeks a Product Security Engineer in Chennai (Work in Office) to strengthen the security posture across the product lifecycle. You will partner with product management, engineering, and operations to assess risks, define secure development standards, enforce policies, and implement best practices to protect customers’ data and operations.

You will review architectures, perform threat modeling, conduct security code reviews, manage vulnerabilities, and integrate security testing into the

Qualifications

• Bachelor’s degree or equivalent practical experience in CS/InfoSec.
• 5+ years in product security or application security roles.
• Strong understanding of web app vulnerabilities and secure coding practices.

Responsibilities

• Review security architectures and designs for new features to identify risks and controls.
• Lead threat modeling exercises for applications and systems.
• Perform manual and automated security code reviews to identify vulnerabilities.
• Participate in vulnerability management with triage and tracking of findings.
• Integrate security testing into CI/CD via SAST, DAST, and SCA workflows.
• Develop and maintain security tooling and automation to improve efficiency.
• Deliver security training and awareness to engineering teams.
• Provide security incident response support for product-related incidents.
• Promote security-first development practices across the organization.

Skills

Application security

Secure coding practices

OWASP Top 10

Programming languages (Python, Java,Go

Security testing tools - SAST/DAST/SCA

CI/CD security integration

Cloud security (AWS)

Cryptographic principles

Education

Bachelor’s degree in Computer Science or Information Security

Tools

SAST

DAST

SCA

CI/CD pipelines

Job description

Product Security Engineer – Chennai (Work in Office)

We are seeking a Product Security Engineer to play a critical part in building and evolving Quvia’s security posture across our products’ entire lifecycle. In this highly impactful role, you’ll partner with product management, engineering, and operations teams to assess product risks, define secure development standards, enforce security policies, and implement best practices to protect our products and, by extension, our customers’ data and operations.

Key Responsibilities

• Security Architecture & Design Review: Collaborate with product and engineering teams to review designs and architectures for new features and products, identifying potential security risks and recommending appropriate controls and mitigations.
• Threat Modeling: Conduct threat modeling exercises for applications and systems to proactively identify and address potential security weaknesses.
• Security Code Review: Perform manual and automated security code reviews to identify vulnerabilities such as OWASP Top 10, common weaknesses (CWEs), and other security flaws.
• Vulnerability Management: Participate in the vulnerability management process, including triage, prioritization, and tracking of vulnerabilities identified through various sources (e.g., pen tests, bug bounties, internal scans).
• Security Testing: Work with QA and development teams to integrate security testing into the CI/CD pipeline, including static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA).
• Security Tooling & Automation: Evaluate, implement, and maintain security tools and technologies to improve the efficiency and effectiveness of our product security program. Develop automation scripts to streamline security tasks.
• Security Training & Awareness: Contribute to developing and delivering security training and awareness programs for engineering teams.
• Incident Response Support: Provide security expertise and support during security incidents related to products.
• Security Best Practices: Research and stay up-to-date with the latest security threats, vulnerabilities, and industry best practices. Evangelize and promote security-first development principles within the organization.

What You’ll Need

• Education: Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• Experience: 5+ years of experience in product security, application security, or a similar role.
• Technical Skills:
  • Strong understanding of application security principles, secure coding practices, and common web application vulnerabilities (e.g., OWASP Top 10).
  • Proficiency in at least one programming language (e.g., Python, Java, Go, Node.js, C#) and the ability to review code for security flaws.
  • Experience with security testing tools (SAST, DAST, SCA) and methodologies.
  • Familiarity with cloud security principles and practices – AWS.
  • Understanding of cryptographic principles and secure communication protocols.
  • Experience with CI/CD pipelines and integrating security into the development lifecycle.
  • Knowledge of common security frameworks and standards (e.g., NIST, ISO 27001) is a plus.

Quvia is an Equal Opportunity Employer. Employment opportunities at Quvia are based upon one’s qualifications and capabilities to perform the essential functions of a particular job. All employment opportunities are provided without regard to race, religion, sex (including sexual orientation and transgender status), pregnancy, childbirth or related medical conditions, national origin, age, veteran status, disability, genetic information, or any other characteristic protected by law.