Security Engineer

DNEG Group; Mumbai; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

DNEG Group in Mumbai is seeking a Security Engineer to assess applications, cloud services, AI use cases, and third-party tools, documenting risks and recommending practical controls. You will drive security reviews and coordinate with engineering, product, and cloud teams to ensure secure designs and implementations.

The role requires independent review ownership, clear evidence-based recommendations, and strong communication to both technical and non-technical stakeholders.

Qualifications

• Approximately five years of relevant experience in application security, cloud security, security engineering, or security architecture.
• Experience reviewing application designs and applying secure development practices, threat modelling, and risk-based remediation.
• Working knowledge of application and API security testing, including code, dependency, and dynamic testing approaches.
• Hands-on understanding of security controls in at least one major cloud platform, particularly identity, networking, data protection, and monitoring.
• Strong written communication and the ability to work with engineers and stakeholders to resolve identified risks.

Responsibilities

• Review application and API designs for authentication, authorization, data protection, secure integration, and common attack paths.
• Perform threat modelling for new systems and significant changes, and recommend controls that can be implemented and verified.
• Assess cloud architectures and configurations, including identity, network exposure, secrets, encryption, logging, and workload security.
• Review proposed AI applications and services for data exposure, access control, unsafe outputs, prompt injection, and third-party dependencies.
• Evaluate third-party tools before company use by reviewing their security posture, data flows, permissions, integrations, and relevant assurance evidence.
• Plan and run proof of concepts for application, cloud, and AI security tools using agreed evaluation criteria; document effectiveness, integration needs, and limitations.
• Prepare concise risk assessments and recommendations, including proposed conditions or remediation needed before approval.
• Track findings with system and service owners, validate remediation evidence, and identify unresolved risks for escalation.

Skills

Application security

Cloud security

Security architecture

Threat modelling

Security testing

Communication

Education

Bachelor's degree in CS/IT/Cybersecurity

Job description

Security Engineer

Overview

DNEG is seeking a security professional to assess applications, cloud services, AI use
cases, and third-party tools before and during their use across the company. The role
combines practical security architecture reviews with hands-on evaluation of security
solutions. The successful candidate will document risks, recommend workable controls,
and support informed approval decisions.

Mandatory Requirements and Expectations

Own defined security reviews independently and
escalate material risks or complex decisions to senior security stakeholders.
Provide clear, evidence-based recommendations that account for security risk,
business use, and implementation effort.
Work closely with engineering, cloud, product, and other internal teams to
understand designs and agree on practical actions.
Maintain accurate review records, decisions, conditions, and follow-up actions for
the security approval process.
Communicate findings constructively to both technical and non-technical
stakeholders.

Duties and Operational Responsibilities

• Review application and API designs for authentication, authorization, data protection, secure integration, and common attack paths.
• Perform threat modelling for new systems and significant changes, and recommend controls that can be implemented and verified.
• Assess cloud architectures and configurations, including identity, network exposure, secrets, encryption, logging, and workload security.
• Review proposed AI applications and services for data exposure, access control, unsafe outputs, prompt injection, and third-party dependencies.
• Evaluate third-party tools before company use by reviewing their security posture, data flows, permissions, integrations, and relevant assurance evidence.
• Plan and run proof of concepts for application, cloud, and AI security tools using agreed evaluation criteria; document effectiveness, integration needs, and limitations.
• Prepare concise risk assessments and recommendations, including proposed conditions or remediation needed before approval.
• Track findings with system and service owners, validate remediation evidence, and identify unresolved risks for escalation.

Contribute to security standards, review checklists, and reusable design guidance to improve consistency across assessments.

Mandatory Job Requirements

A successful candidate should demonstrate the following experience and capabilities:

• Approximately five years of relevant experience in application security, cloud security, security engineering, or security architecture.
• Experience reviewing application designs and applying secure development practices, threat modelling, and risk-based remediation.
• Working knowledge of application and API security testing, including code, dependency, and dynamic testing approaches.
• Hands-on understanding of security controls in at least one major cloud platform, particularly identity, networking, data protection, and monitoring.
• Ability to evaluate unfamiliar technologies through proof of concepts, define success criteria, and present a balanced recommendation.
• Experience assessing third-party products or services, including how they access, process, store, and share company or client data.
• Working knowledge of security risks in AI-enabled applications and the controls used to address them.
• Strong written communication and the ability to work with engineers and stakeholders to resolve identified risks.

Desirable Experience

• Direct experience assessing generative AI applications, including retrieval-based systems or applications that use external tools.
• Experience with security assurance reports, vendor questionnaires, and recognized security frameworks such as ISO 27001, NIST, CIS, or OWASP guidance.
• Experience evaluating or operating application security, cloud security, or AI security tooling.

Education

A bachelor's degree in computer science, information technology, cybersecurity,
or equivalent practical experience is desirable.
Relevant security or cloud certifications are desirable but are not a substitute for
demonstrated practical experience.