Senior Application Security Engineer

Jobgether; India; Remote; INR 3,500,000 - 7,000,000; Full time

Benefits offered by this job

Remote work

Health and wellbeing benefits

Professional development

Inclusive workplace

Job summary

Jobgether seeks a Senior Application Security Engineer in India, remote. You will shape security across a large-scale enterprise, building scalable guardrails, AI-powered tools, and secure development practices from commit to production.

You will work with engineering, architecture, and DevOps leaders to drive measurable improvements in secure software delivery, API protection, and software supply chain security, spanning CI/CD, SBOM, and LLM security.

Qualifications

• 6+ years in Application Security or Secure Software Development.
• Experience designing controls for CI/CD and repos (GitHub/GitLab/Jenkins).
• Hands-on with SAST/DAST/SCA and container scanning for developers.
• WAF and API protection implementation and remediation.
• Knowledge of SLSA/NIST SSDF, build integrity, secrets management, signing.
• Security controls in AWS/Azure/GCP and OWASP Top 10 for web apps/APIs.
• Experience with LLM security concepts and AI agents is a plus.
• Production-quality automation using Python, Java, Go, or JS.

Responsibilities

• Build scalable secure SDLC practices, guardrails, and reference architectures.
• Develop vulnerability prioritization across code, pipelines, and services.
• Establish threat modeling for apps, APIs, pipelines, and AI agents.
• Architect security controls for CI/CD platforms (GitHub Actions, Jenkins, GitLab, Azure DevOps).
• Design automated SAST, DAST, SCA, and container scanning workflows.
• Automate SBOM, secrets detection, dependency scanning, and supply chain tooling.
• Build AI-powered security tools that review PRs and suggest remediations.
• Define guardrails for AI agents, with least-privilege and audit logging.
• Advise leadership on risk and tool selection with measurable impact.
• Mentor teams and contribute to a Security Champions program.

Skills

Application Security

Secure SDLC

CI/CD Security

SAST

DAST

SCA

Container Security

WAF

API Security

OWASP Top 10

LLM Security

Python

Java

Go

JavaScript

Tools

GitHub Actions

Jenkins

GitLab

Azure DevOps

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Application Security Engineer based in India. This is an opportunity to shape application security across a large-scale enterprise technology environment, helping engineering teams build and deploy secure software from the first commit through production. The role focuses on creating scalable security capabilities, automated guardrails, and AI-powered tools that make secure development the default. You will work closely with engineering, architecture, and DevOps leaders, influencing technical roadmaps and driving measurable improvements. Your scope will span secure software development, CI/CD and software supply chain security, API protection, and emerging AI and LLM security practices. Rather than simply identifying vulnerabilities, you will build solutions that prevent recurring risks and enable teams to address threats efficiently. The position is remote, offering the opportunity to collaborate across teams while advancing enterprise-wide cybersecurity practices.

Accountabilities

• Build and scale secure software development lifecycle practices, including secure coding standards, reference architectures, and developer-friendly security guardrails.
• Develop vulnerability prioritization capabilities across code, pipelines, and deployed services, driving remediation through measurable outcomes.
• Establish scalable threat modeling practices for applications, APIs, delivery pipelines, RAG architectures, and autonomous AI agents.
• Architect security controls for CI/CD platforms such as GitHub Actions, Jenkins, GitLab, and Azure DevOps, ensuring security is integrated into pipelines by default.
• Design and optimize automated SAST, DAST, SCA, and container scanning workflows, improving detection quality and reducing false positives.
• Automate API discovery, dependency scanning, software bill of materials (SBOM) generation, secrets detection, and other software supply chain security capabilities.
• Build AI-powered security tools and agent workflows that review pull requests, identify insecure patterns, generate targeted security tests, triage findings, and propose remediation changes for human review.
• Define security guardrails for AI agents, including least-privilege access, human approval processes, output-quality evaluation, and audit logging.
• Establish frameworks for secure AI adoption across enterprise applications, addressing data protection, access controls, model inputs and outputs, and misuse prevention.
• Advise product, platform, and DevOps leaders, translate technical risks into business decisions, select and validate security tools, and demonstrate their impact through metrics.
• Mentor engineering teams in secure coding and pipeline practices, while helping develop a sustainable Security Champions program.

Requirements

• At least 6 years of experience in Application Security, Product Security, or Secure Software Development, with demonstrated experience building security capabilities rather than only operating existing tools.
• Experience designing security controls for CI/CD pipelines and source code repositories, including GitHub, GitLab, Jenkins, or comparable platforms.
• Hands-on experience implementing and tuning SAST, DAST, SCA, and container scanning solutions to produce actionable results developers can trust.
• Experience implementing WAF and API protection capabilities and driving vulnerability remediation to completion.
• Knowledge of SLSA and NIST SSDF principles, including build integrity, secrets management, and artifact signing.
• Experience designing security controls in AWS, Azure, or GCP environments.
• Strong understanding of OWASP Top 10 for web applications and APIs, CWE classifications, and secure coding practices.
• Working knowledge of the OWASP Top 10 for LLM Applications and MITRE ATLAS.
• Ability to write production-quality automation and tooling in at least one programming language, such as Python, Java, Go, or JavaScript/Node.js.
• Strong communication and influencing skills, with the ability to work effectively with developers, DevOps engineers, architects, and leadership.
• An automation-first mindset, ownership of initiatives from design through delivery, and the ability to balance security outcomes with engineering velocity.

Preferred Qualifications

• Experience building LLM-powered developer or security tools, including prompt and skill design, tool and MCP integrations, and evaluation of output quality and false-positive rates.
• Experience implementing software signing and provenance using Sigstore, Cosign, or similar technologies.
• Experience integrating SBOM generation and software composition analysis into CI/CD workflows.
• Familiarity with runtime protection solutions such as API security platforms, RASP, or container EDR.
• Experience with GitOps, infrastructure-as-code scanning using Terraform or CloudFormation, and policy-as-code guardrails.
• Experience leading or contributing to responses to software supply chain or dependency poisoning incidents.
• Relevant certifications such as OSWE, CSSLP, GPCS, GWEB, or GCSA.
• Familiarity with agentic AI frameworks such as LangGraph or similar orchestration technologies.

Benefits

• Remote work: The position is designated as Remote/Teleworker, with work primarily performed from home.
• Health and wellbeing: Access to a comprehensive benefits offering intended to support employees’ physical, financial, and emotional wellbeing.
• Professional development: Career development programs designed to support progression, specialization, and opportunities to apply skills across different areas.
• Inclusive workplace: A culture that values diverse backgrounds, individual contributions, and flexibility in managing professional and personal needs.

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.