Senior Application Security Specialist

Mployee.me; Pune District; Hybrid; INR 1,800,000 - 3,200,000; Full time

Job summary

Mployee.me is seeking a development-first security engineer in Pune, offering a hybrid work model. You will fix vulnerabilities in code, upgrade components, and build automation to prevent issues. The role splits roughly 70% development and 30% security testing across web apps and APIs.

You will own fixes end to end, from finding to merged, tested changes, and collaborate with teams to ship secure software. 5+ years of combined development and security experience is expected.

Qualifications

• 5+ years total experience: ~3.5 years in development and ~1.5+ years in security.
• Proven track record of fixing security issues in code.

Responsibilities

• Fix vulnerabilities directly in application code and add tests.
• Upgrade vulnerable libraries, frameworks and third‑party components.
• Build internal security tooling and automate checks in CI/CD.
• Integrate SAST/DAST/SCA into pipelines and tune rules.
• Test web apps and APIs for exploitable vulnerabilities and document findings.

Skills

Security engineering

Vulnerability assessment

Code review

CI/CD

SAST/DAST/SCA

Tools

Burp Suite

Semgrep

CodeQL

Terraform

Docker

Job description

Location: Pune (Hybrid)

Experience: 5+ years (about 70% software development, 30% security)

About the role

This is a development-first security role. About 70% of the work is engineering: you will fix vulnerabilities in application code, upgrade vulnerable components, and build the tooling and automation that keep issues from coming back. The other 30% is security testing across our web apps and APIs. You own each fix end to end, from the finding to a merged, tested change.

What you will do

Development and remediation

• Fix vulnerabilities directly in application code, in whatever language or framework the application uses, and add tests that prove the fix.
• Fix root causes, not single instances: build shared validation, output encoding, parameterized queries, and authorization checks that remove whole classes of vulnerabilities.
• Upgrade vulnerable libraries, frameworks, and third-party components, resolve breaking changes, and keep builds and tests passing.
• Build internal security tooling and automation: scanner integrations, triage and reporting scripts, and checks that catch issues before release.
• Integrate SAST, DAST, and SCA tooling such as Aikido into CI/CD pipelines, and tune the rules to cut noise.
• Fix infrastructure and configuration issues: web server and TLS settings, cloud IAM and network rules, container and Kubernetes configuration, infrastructure-as-code, and CI/CD pipeline hardening.
• Where code or infrastructure is owned by another team, raise the change yourself as a pull request and drive it to merge.

Security testing

• Test web applications and APIs for exploitable vulnerabilities.
• Review code and design for flaws in authentication, authorization, session handling, data flows, and secrets management.
• Run and tune vulnerability scans across applications, hosts, or cloud accounts, and prioritize findings by exploitability and business impact alongside CVSS.
• Retest fixes and close findings only when the vulnerability is confirmed resolved.

Reporting and communication

• Write clear findings and fix notes with reproduction steps, evidence, risk rating, and the change made.
• Agree on realistic remediation timelines with engineers, and share secure coding patterns so the same issues stop recurring.

What you bring

Experience

• 5+ years total: approx. 3.5 years building and shipping production software as a developer, and approx. 1.5+ years of hands‑on security work such as VAPT, application security, or secure code review.
• A track record of fixing security issues in code.

Development expertise

• Production‑level depth in at least two of: Java, C#/.NET, JavaScript/TypeScript, Python, PHP, Go, Swift, or Kotlin. Comfortable reading and changing code in languages you know less well.
• Able to land a correct, tested fix in an unfamiliar codebase without breaking existing behavior.
• Web and API development: REST and GraphQL services; authentication with OAuth 2.0, OpenID Connect, and JWT; session management; databases and ORMs.
• Unit and integration testing, Git-based workflows, pull requests, and code review.
• CI/CD pipelines, Docker, Kubernetes, and infrastructure-as-code such as Terraform or CloudFormation.
• Working knowledge of Nginx, Apache, IIS, and TLS configuration.
• Scripting in Python, Bash, or PowerShell to automate testing and remediation.

Communication

• Clear written findings and the ability to explain risk and trade‑offs to engineers and business stakeholders.

Nice to have

• Web and API: manual testing with Burp Suite Professional; OWASP Top 10 and ASVS; injection, authentication and session flaws, access control (IDOR/BOLA), SSRF, and OAuth and JWT weaknesses.
• Secure code review: spotting vulnerable patterns in code and using SAST and SCA results to find and fix real issues.
• Built security tools, Burp extensions, or custom SAST rules (for example, Semgrep or CodeQL).
• Threat modeling and secure design review experience.
• Familiarity with compliance evidence requirements (ISO 27001, SOC 2, PCI DSS) as they relate to vulnerability remediation.

What success looks like

• Vulnerabilities reach merged, tested fixes within agreed timelines.
• Recurring vulnerability classes decline because fixes address root causes.
• The tooling and automation you build catch issues before release and cut manual triage.
• Development teams see you as a fellow engineer who ships fixes alongside them.
• Cloud misconfiguration and patch exposure windows stay short.