Product security Engineer : 26-02135

Akraya; Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Benefits offered by this job

Returnship program

Women Back-to-Work initiative

Job summary

Akraya is seeking an experienced Application Security professional to safeguard cloud-based networking and security products. You will collaborate with engineering to embed security across the SDLC and leverage advanced tooling to identify and remediate vulnerabilities.

Responsibilities include threat modeling, conducting SAST/DAST, and leading secure coding training for engineering and DevOps teams, with emphasis on AWS/Azure/GCP and containerized environments.

Qualifications

• 5+ years of Application Security or Product Security experience.
• Vulnerability Assessment (VA) & Penetration Testing (PT).
• Threat Modeling (STRIDE preferred).
• Static Application Security Testing (SAST).
• Dynamic Application Security Testing (DAST).
• Manual Web Application Penetration Testing.
• Strong communication and stakeholder management skills.

Responsibilities

• Perform application and product security assessments for SaaS and on-prem DNS/DHCP solutions across microservices and containerized architectures.
• Drive threat modeling for new and existing features, documenting abuse cases and prioritized mitigations.
• Plan, execute, and analyze penetration tests, leveraging standard frameworks and AI-assisted tooling to accelerate test design and reporting.
• Evaluate and tune SAST, DAST, SCA, and container security tools to reduce noise and improve signal quality.
• Partner with development teams to review designs and code changes, define secure coding patterns, and integrate security stories into agile backlogs.
• Define and validate security controls for authentication, authorization, encryption, secrets management, and secure network communication.
• Collaborate with cloud platform teams (AWS, GCP, Azure) to assess and harden Kubernetes, containers, and CI/CD pipelines, including policy-as-code.
• Apply AI and automation tooling to correlate findings, reduce false positives, and generate remediation guidance responsibly.
• Lead security root-cause reviews for product issues and translate lessons learned into patterns, guardrails, and developer education.
• Deliver targeted secure coding, OWASP Top 10/API, and threat modeling training for engineering and DevOps teams.

Skills

Python

Threat Modeling

SAST/DAST Tooling

Cloud Security

Penetration Testing

Security Automation

Tools

Burp Suite

OWASP ZAP

CodeQL

Coverity

SonarQube

Job description

Primary Skills: Python (advanced), Threat Modeling (advanced), SAST/DAST Tooling (advanced), Cloud Security (advanced), Penetration Testing (advanced) Contract Type: Permanent Location: Bangalore Duration: Full-time #WBW #LP

NOTE: Role is open to Women Back to Work candidates with a career gap Women Back to Work, the prominent global organization specializing in returnship programs, is pleased to collaborate with one of the leading companies in the Networking & Cybersecurity industry, to extend return-to-work opportunities.

The WBW returnship program is exclusively designed for professionals who have taken a career break, whether for caregiving responsibilities, raising a child, or other voluntary reasons. If you have a gap in your work history, we warmly encourage you to apply. This returnship provides a platform to enhance your skills, build on your experience, and cultivate meaningful connections.

Job Summary: This role involves ensuring the security of cloud-based networking and security products through rigorous assessments and secure design practices. You will collaborate with engineering teams to embed security throughout the software development lifecycle and leverage advanced tooling to identify and resolve vulnerabilities. Your work will directly contribute to protecting critical infrastructure and customer data.

Key Responsibilities

• Perform application and product security assessments for SaaS and on-prem DNS/DHCP solutions across microservices and containerized architectures
• Drive threat modeling for new and existing features, documenting abuse cases and prioritized mitigations
• Plan, execute, and analyze penetration tests, leveraging standard frameworks and AI-assisted tooling to accelerate test design and reporting
• Evaluate and tune SAST, DAST, SCA, and container security tools (e.g., Coverity, CodeQL, SonarQube, Contrast) to reduce noise and improve signal quality
• Partner with development teams to review designs and code changes, define secure coding patterns, and integrate security stories into agile backlogs
• Define and validate security controls for authentication, authorization, encryption, secrets management, and secure network communication
• Collaborate with cloud platform teams (AWS, GCP, Azure) to assess and harden Kubernetes, containers, and CI/CD pipelines, including policy-as-code
• Apply AI and automation tooling (e.g., code analysis assistants, LLM-assisted triage) to correlate findings, reduce false positives, and generate remediation guidance responsibly
• Lead security root-cause reviews for product issues and translate lessons learned into patterns, guardrails, and developer education
• Deliver targeted secure coding, OWASP Top 10/API, and threat modeling training for engineering and DevOps teams

Must-Have Skills

• 5+ years of Application Security or Product Security experience
• Vulnerability Assessment (VA) & Penetration Testing (PT)
• Threat Modeling (STRIDE preferred)
• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Manual Web Application Penetration Testing
• Burp Suite
• OWASP ZAP (ZAP Proxy)
• Python OR Go OR Shell Scripting
• Security Automation
• Cloud Security – AWS OR Azure OR GCP
• ISO 27001 OR NIST
• Strong communication and stakeholder management skills

Industry Experience: Experience in securing cloud-native environments and familiar with industry standards and frameworks such as ISO 27001, NIST, PCI DSS, and GDPR is preferred