Senior Security Engineer

Greenlight; Bengaluru; On-site; INR 4,000,000 - 6,500,000; Full time

Job summary

Greenlight is seeking a Senior Product Security Engineer to join our security team and safeguard our products across the entire SDLC. You will collaborate with engineering, product, and operations to embed security best practices from design through deployment, shaping our security posture and protecting customer data.

You will build and operate security automation, lead threat modeling for AI systems, perform pen tests, triage findings, and drive secure development standards across a fast-paced

Qualifications

• 5+ years of experience finding security vulnerabilities and security code reviews.
• 2-4 years experience with threat modeling and ability to find design problems from architecture and data flows.
• Experience with exploiting common security vulnerabilities.
• Deep technical knowledge of web and mobile app security, secure coding practices, and attack mitigations.
• Experience integrating or building AI-powered tools to assist with vulnerability detection, code review or threat modeling.
• Experience creating software to enable security processes, especially those leveraging AI/ML for automation.
• End-to-end experience implementing and managing tools for Product Security (API Security, Mobile Protection, SAST, runtime scanning, etc.).
• Experience with CI/CD pipelines and related security tools for web and mobile apps.
• Hands-on security tooling: SAST, DAST, IAST, and penetration testing; fuzzing a plus.
• Strong scripting, automation, and exploit-writing skills.
• Strong cloud security knowledge in AWS environments.
• Excellent communication and collaboration across engineering, product, and security teams.

Responsibilities

• Support in executing a comprehensive product security strategy aligned with company goals and risk appetite.
• Work hands-on across code, infrastructure, and CI/CD to create agents, services and pipelines for risk detection and remediation.
• Design, build and operate security automation for the SDLC integrated into CI/CD.
• Perform design and implementation reviews of Greenlight products from a security perspective.
• Establish and enforce secure development standards and best practices across the org.
• Lead threat modeling exercises for AI/LLM systems with advanced security and privacy practices.
• Automate testing and validation of security across products and platform components.
• Conduct penetration testing and retesting to validate fixes.
• Triage findings from security researchers and lead incident response for PSIRT.
• On-call support for incident response and security events.
• Collaborate with engineering, product, and platform teams to embed security-by-design patterns.
• Provide guidance to developers to prevent vulnerabilities.
• Prioritize and remediate security vulnerabilities in a timely manner.
• Develop and maintain software supply chain protections including SBOMs and attestations.
• Build automation for static/dynamic analysis and scalability across products.
• Use telemetry to measure control effectiveness and drive action.
• Document runbacks, mentor engineers, and champion secure engineering practices.
• Foster security awareness and ownership across teams.

Skills

Security vulnerability research

Security code reviews

Threat modeling

CI/CD security

AI/ML for security

Security automation

Scripting & automation

Tools

SAST tools

DAST tools

IAST tools

Penetration testing tools

Job description

Greenlight is a family technology company on a mission to help families raise financially smart kids and navigate life together. Its suite of products — including the Greenlight app, debit card, Safe Family GPS trackers, and Family Hub — brings together financial tools, safety features, and everyday family management in one connected experience. Designed for busy families who want convenience without compromise, Greenlight continues to innovate alongside the evolving needs of modern life. Today, more than 6.5 million family members trust Greenlight to stay in sync.

At Greenlight, we're here to make the day-to-day easier and futures brighter, so families can spend less time managing life, and more time living it. That's why we get out of bed every morning.

We are seeking a Senior Product Security Engineer to join our growing security team. This role will be critical in ensuring the security of our products across the entire software development lifecycle (SDLC) and provide support on different security initiatives. You will work closely with engineering, product, and operations teams to embed security best practices from design through to deployment. You will play a critical role in shaping our security posture, embedding security into our development lifecycle, and protecting our customers' data.

Technologies we use

• Backend: Node.js, Kotlin, Java, Go
• Frontend: React, Redux, Swift, Kotlin
• REST, gRPC, graphQL
• AWS
• MySQL, DynamoDB, Redis
• Kubernetes, Ambassador, Helm, Rancher

What you will be doing

• Support in executing a comprehensive product security strategy that aligns with the company's goals and risk appetite
• You will work hands on across code, infrastructure, and CI/CD to create agents, services and pipelines that detect, prevent and remediate risks leveraging AI where it adds value.
• Design, build and operate security automation for the SDLC (code scanning, dependency risk management, secrets detection, policy-as-code) integrated into CI/CD.
• Perform Manual Design and Implementation Reviews of Greenlight products and services from a security perspective
• Establish and enforce secure development standards (i.e. API security, Security patterns, IaC, etc.) and best practices across the organization.
• Serve as SME on the practical security of our AI and LLM ecosystem. Lead threat modeling exercises for novel AI systems applying advanced security and privacy best practices.
• Leverage automations and tools to continuously test, fuzz and validate products and platform components for security issues
• Perform Penetration testing and retesting to validate fixes
• Responsible for triaging findings from security researchers and leading incident response for PSIRT
• OnCall support for incident response and lead product-related security events and vulnerabilities
• Partner with engineering, product, and platform teams to embed security by design patterns, drive threat modeling and land pragmatic guardrails that unblock developers
• Provide guidance and education to developers that help prevent the authoring of vulnerabilities.
• Partner closely with engineering, product, and platform teams to prioritize and remediate security vulnerabilities in a timely and efficient manner
• Develop and maintain software supply chain protections including SBOM generation/verification, artifact signing/attestation, and provenance enforcement.
• Build automation for static and dynamic analysis and frameworks that enable Greenlight to scale consistently across all our products.
• Use data and telemetry to measure control effectiveness, build dashboards and alerts that turn signals into action.
• Document runbacks and API, mentor engineers and champion secure engineering practices
• Foster a culture of security awareness and ownership across the Engineering and Product organizations
• Stay current with the latest security threats, vulnerabilities, and industry best practices to continuously evolve our security controls and processes

What You Should Bring

• 5+ years of experience finding security vulnerabilities, security code reviews and knowledge of secure code development for the technology stack at Greenlight
• 2-4 years experience with the threat modeling process and ability to find design problems based on technical architecture and data flow diagrams
• Experience with exploiting common security vulnerabilities
• Deep technical knowledge of web and mobile application security, common vulnerabilities, secure coding practices, common exploit mitigations and secure architecture patterns
• Experience integrating or building AI-powered tools to assist with vulnerability detection, code review or threat modeling.
• Experience creating software that enables security processes especially those leveraging AI/ML for automation or augmentation.
• End to end experience on implementing and managing tools for Product Security (i.e. API Security, Mobile Protection, SAST, runtime scanning, etc.)
• Experience with software development and automation that enables security processes. Deep technical knowledge of CI/CD pipelines and relevant tools for web and mobile applications.
• Hands-on experience with security tools for SAST, DAST, IAST, and penetration testing. Fuzzing skills are good to have.
• Skilled in scripting, automation and exploit writing.
• Strong understanding of cloud security principles in AWS environments
• Strong communication skills with the ability to articulate complex security concepts to both technical and non-technical audiences.
• Strong product sense for rapid iteration and refinement based on data, combined with a collaborative mindset to work closely with engineers, product managers, and security analysts in a fast-paced environment

Nice to have

• Strong at abstraction turning bespoke engagements into reusable patterns and reference implementation.
• Security assessment of IoT hardware/firmware
• Contribution to security community including public research, bug bounty, presentations, blogs, etc
• Experience at Fintech or similar regulated companies
• Startup Agility and stay curious mindset

Who we are

It takes a talented team to aim for a mission like ours. We're looking for people who ask "is it bold enough?" People who bring their real selves to the table and push the people around them to do the same. We win by never hesitating to jump in, offer a hand, or share the credit, because we know we're stronger together than apart. And through all of it, the mission stays the thing we measure ourselves against: are we doing right by the families counting on us?

Greenlight is an equal opportunity employer and will not discriminate against any employee or applicant based on age, race, color, national origin, gender, gender identity or expression, sexual orientation, religion, physical or mental disability, medical condition (including pregnancy, childbirth, or a medical condition related to pregnancy or childbirth), genetic information, marital status, veteran status, or any other characteristic protected by federal, state or local law.

Greenlight is committed to an inclusive work environment and interview experience. If you require reasonable accommodations to participate in our hiring process, please reach out to your recruiter directly or email [e-mail].

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.