Security Engineer

Dneg; Mumbai; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

DNEG is seeking a Security Engineer in Mumbai to assess applications, cloud services, AI use cases, and third-party tools. The role blends security architecture reviews with hands-on evaluation and requires documenting risks and recommending workable controls for informed approvals.

The candidate should have extensive experience in application and cloud security, threat modelling, and risk-based remediation, plus strong communication with engineers and stakeholders.

Qualifications

• Approximately five years of relevant experience in application security, cloud security, security engineering, or security architecture.
• Experience reviewing application designs and applying secure development practices, threat modelling, and risk-based remediation.
• Working knowledge of application and API security testing, including code, dependency, and dynamic testing approaches.
• Hands-on understanding of security controls in at least one major cloud platform, particularly identity, networking, data protection, and monitoring.
• Ability to evaluate unfamiliar technologies through proof of concepts, define success criteria, and present a balanced recommendation.
• Experience assessing third-party products or services, including how they access, process, store, and share data.
• Working knowledge of security risks in AI-enabled applications and the controls used to address them.
• Strong written communication and the ability to work with engineers and stakeholders to resolve identified risks.

Responsibilities

• Review application and API designs for authentication, authorization, data protection, secure integration, and common attack paths.
• Perform threat modelling for new systems and significant changes, and recommend controls that can be implemented and verified.
• Assess cloud architectures and configurations, including identity, network exposure, secrets, encryption, logging, and workload security.
• Review proposed AI applications and services for data exposure, access control, unsafe outputs, prompt injection, and third-party dependencies.
• Evaluate third-party tools before company use by reviewing their security posture, data flows, permissions, integrations, and relevant assurance evidence.
• Plan and run proof of concepts for application, cloud, and AI security tools using agreed evaluation criteria; document effectiveness, integration needs, and limitations.
• Prepare concise risk assessments and recommendations, including proposed conditions or remediation needed before approval.
• Track findings with system and service owners, validate remediation evidence, and identify unresolved risks for escalation.

Skills

Application security

Cloud security

Threat modelling

Risk remediation

Security architecture

Education

Bachelor's degree in CS/IT

Security certifications desirable

Job description

Security Engineer

Overview

DNEG is seeking a security professional to assess applications, cloud services, AI use cases, and third-party tools before and during their use across the company. The role combines practical security architecture reviews with hands‑on evaluation of security solutions. The successful candidate will document risks, recommend workable controls, and support informed approval decisions.

Mandatory Requirements and Expectations

• Own defined security reviews independently and elevate material risks or complex decisions to senior security stakeholders.
• Provide clear, evidence-based recommendations that account for security risk, business use, and implementation effort.
• Work closely with engineering, cloud, product, and other internal teams to understand designs and agree on practical actions.
• Maintain accurate review records, decisions, conditions, and follow‑up actions for the security approval process.
• Communicate findings constructively to both technical and non-technical stakeholders.

Duties and Operational Responsibilities

• Review application and API designs for authentication, authorization, data protection, secure integration, and common attack paths.
• Perform threat modelling for new systems and significant changes, and recommend controls that can be implemented and verified.
• Assess cloud architectures and configurations, including identity, network exposure, secrets, encryption, logging, and workload security.
• Review proposed AI applications and services for data exposure, access control, unsafe outputs, prompt injection, and third-party dependencies.
• Evaluate third‑party tools before company use by reviewing their security posture, data flows, permissions, integrations, and relevant assurance evidence.
• Plan and run proof of concepts for application, cloud, and AI security tools using agreed evaluation criteria; document effectiveness, integration needs, and limitations.
• Prepare concise risk assessments and recommendations, including proposed conditions or remediation needed before approval.
• Track findings with system and service owners, validate remediation evidence, and identify unresolved risks for escalation.

Contribute to security standards, review checklists, and reusable design guidance to improve consistency across assessments.

Mandatory Job Requirements

A successful candidate should demonstrate the following experience and capabilities:

• Approximately five years of relevant experience in application security, cloud security, security engineering, or security architecture.
• Experience reviewing application designs and applying secure development practices, threat modelling, and risk-based remediation.
• Working knowledge of application and API security testing, including code, dependency, and dynamic testing approaches.
• Hands‑on understanding of security controls in at least one major cloud platform, particularly identity, networking, data protection, and monitoring.
• Ability to evaluate unfamiliar technologies through proof of concepts, define success criteria, and present a balanced recommendation.
• Experience assessing third‑party products or services, including how they access, process, store, and share company or client data.
• Working knowledge of security risks in AI‑enabled applications and the controls used to address them.
• Strong written communication and the ability to work with engineers and stakeholders to resolve identified risks.

Desirable Experience

• Direct experience assessing generative AI applications, including retrieval‑based systems or applications that use external tools.
• Experience with security assurance reports, vendor questionnaires, and recognized security frameworks such as ISO 27001, NIST, CIS, or OWASP guidance.
• Experience evaluating or operating application security, cloud security, or AI security tooling.

Education

A bachelor's degree in computer science, information technology, cybersecurity, or equivalent practical experience is desirable. Relevant security or cloud certifications are desirable but are not a substitute for demonstrated practical experience.