Senior Application Security Engineer

One Identity; Panna; Sur place; INR 3 000 000 - 6 000 000; Plein temps

Résumé du poste

One Identity in India seeks a Senior Application Security Engineer to strengthen the secure development lifecycle across .NET and Java codebases. You will lead threat modeling, define early security requirements, and guide engineers through architecture discussions to secure products deployed by customers.

You will own static analysis, dependency scanning, and dynamic testing, while shaping secure coding practices and integrating AI-assisted security tooling into reviews.

Qualifications

• Six or more years in software engineering or security, with at least three focused on application or product security.
• Application security experience on a product that customers deploy and operate themselves, with the release and disclosure realities that come with it.
• Code-level fluency in C# and .NET, and enough range to be useful in a Java codebase.
• Hands-on work with AI-assisted development or AI-enabled security tooling within the last six months, and a considered view on where it belongs in a review pipeline.

Responsabilités

• Threat model the things that matter: authentication and session handling, privilege elevation paths, connector and integration boundaries, tenant isolation in hosted offerings, and cryptographic and secrets handling.
• Set security requirements early enough to shape a design; engineering teams should meet you at the architecture stage.
• Provide defensible risk Readouts to product and engineering leadership in release-decision language.
• Own static analysis, dependency scanning, and dynamic testing across product lines; ensure findings are acted upon.
• Raise secure coding standards across a large .NET and Java codebase with patterns, libraries, and reviewed implementations.
• Decide on AI-assisted development review scope and remediation practices.

Connaissances

C# / .NET

Java

Application security

Threat modeling

AI-powered security tools

Outils

Static analysis

Dependency scanning

Dynamic testing

Code reviews

Description du poste

Job Description:

Overview

Senior Application Security Engineer

One Identity · Information Security, Attack Surface

Senior individual contributor · India · Reports to the Director of Information Security

Why this role exists

Our products are the access control layer for the companies that buy them. Identity Manager, Active Roles, Safeguard and OneLogin decide who gets into everything else a customer runs. That sets the security bar for our code higher than it sits at most software companies, and its the reason this role works inside engineering rather than alongside it.

Much of what we build is deployed by customers in their own datacenters. When a defect ships, remediation moves at their upgrade cadence, not ours. That changes where the effort belongs: a design flaw caught in a threat model costs a conversation, and the same flaw caught after release costs a coordinated disclosure and a year of upgrade calls. This role is funded to move security earlier.

Were separating from Quest Software and building an independent security function. The team is lean and globally distributed, and this role is the security voice in the product organization. Scope comes from what you build into the development lifecycle and from what engineering chooses to adopt.

What youll do

Design it right

• Threat model the things that matter: authentication and session handling, privilege elevation paths, connector and integration boundaries, tenant isolation in hosted offerings, and cryptographic and secrets handling. You choose where the depth goes.
• Set security requirements early enough to shape a design instead of contesting one. Engineering teams should meet you at the architecture stage, not at the release gate.
• Give product and engineering leadership a defensible read on which risks are worth carrying, in language a release decision can be made from.

Work in the code

• Youll hold commit access to product repositories. A dependency bump, a patched library, a fix in the code path that produced the finding: submit it, review it, and pair with the engineer who owns that module. PRs, not tickets.
• Own static analysis, dependency scanning, and dynamic testing across the product lines. Tune them until the signal is worth the interruption, and route findings to the team that can act on them.
• Raise the ceiling on secure coding across a large .NET and Java codebase: patterns, libraries, and reference implementations that make the safe approach the convenient one, plus the review depth to know when theyre being used correctly.
• Take a position on AI-assisted development. Engineering is generating code with it, and someone needs to decide what review that code gets, where automated remediation is trusted to open a pull request, and how we verify what it changed.

Stand behind what ships

• Own product vulnerability response end to end: intake from researchers and customers, triage across affected versions, coordinated disclosure, CVE handling, and the advisory customers actually read.
• Turn penetration test and bug bounty findings into fixes and into the systemic change that prevents the next one. Recurrence is the signal that a control is missing, not that a bug was missed.
• Own software composition analysis and SBOM generation across the product lines, including the license and provenance data Legal and customers depend on.
• Make product security evidence available on demand. Customer questionnaires, security reviews, and certification work all draw on the same underlying facts, and they should be produced from one source.

What were looking for

Required

Six or more years in software engineering or security, with at least three focused on application or product security. Equivalent depth counts.

• Application security experience on a product that customers deploy and operate themselves, with the release and disclosure realities that come with it.
• Code-level fluency in C# and .NET, and enough range to be useful in a Java codebase. You read and write production code, not just findings.
• Hands-on work with AI-assisted development or AI-enabled security tooling within the last six months, and a considered view on where it belongs in a review pipeline.

The three above are the bar. Everything below is depth wed like and can build. If you meet the requirements and bring most of the rest, apply. Wed rather assess the gap ourselves than have you decide it for us.

Also matters:

threat modeling at design time with engineering in the room; static, dynamic and composition analysis tooling and the judgment to tune it; identity and authentication protocols including OAuth, OIDC, SAML and SCIM; coordinated vulnerability disclosure and CVE handling; secure code review depth in web and API surfaces; the ability to hold a position with senior engineers and change it when theyre right.

Helpful:

SBOM standards and license compliance, cryptographic review, security champions programs, PCI DSS or FedRAMP applied to a product rather than a company, prior time as a product engineer.

What you should know going in

This role is embedded in engineering by design, with the access to prove it. Youll work across every product line, which means breadth before depth and a constant judgment call about where your attention is worth most. The work is visible to engineering leadership and it reaches customers directly through what ships and what were able to tell them. If you want to be measured by what got fixed rather than what got filed, this is that seat.

Company Description

One Identity enables organizations of all sizes to better secure, manage, monitor, protect, and analyse information and infrastructure to help fuel innovation and drive their businesses forward.

With team members around the globe, we intend to continue to grow revenues and add value to customers.

When you join our team, you will have the opportunity to build and develop products at a scale few others can provide.

Our product portfolio serves a large base of customers and we are addressing the strategic imperatives for enterprise businesses.

Working with some of the most talented employees the industry has to offer, we provide enhanced career opportunities for team members to learn and grow in a rapidly changing environment.

Why work with us?

Life at One Identity means collaborating with dedicated professionals with a passion for technology.

When we see something that could be improved, we get to work inventing the solution.

Our people demonstrate our winning culture through positive and meaningful relationships.

We invest in our people and offer a series of programs that enables them to pursue a career that fulfills their potential.

Our team members’ health and wellness is our priority as well as rewarding them for their hard work.

One Identity is an Equal Opportunity Employer and Prohibits Discrimination and Harassment of Any Kind: One Identity is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment.

All employment decisions at One Identity are based on business needs, job requirements and individual qualifications, without regard to race, color, religion or belief, national, social or ethnic origin, sex (including pregnancy), age, physical, mental or sensory disability, HIV Status, sexual orientation, gender identity and/or expression, marital, civil union or domestic partnership status, past or present military service, family medical history or genetic information, family or parental status, or any other status protected by the laws or regulations in the locations where we operate.

One Identity will not tolerate discrimination or harassment based on any of these characteristics. One Identity encourages applicants of all ages.

Come join us.

Note: We do not use text messaging or third-party messaging apps like Telegram to communicate with applicants, so please exercise caution if you are approached in this way and only interact with people claiming to be One Identity employees if they have an email address ending in @oneidentity.com.

Requirements: