Sr. Engineer: Application Security

Concentrix; Hyderabad; On-site; INR 1,100,000 - 1,900,000; Full time

Job summary

Concentrix seeks a Senior Application Security Engineer to bridge security with software teams, embedding security into SDLC and CI/CD. You will lead a Security Champions program and drive secure coding practices across web, APIs, and mobile apps.

You will perform manual and automated security tests, threat modeling, and coordinate with engineering to remediate vulnerabilities, helping the organization ship secure software.

Qualifications

• Developer-oriented mindset with ability to read and secure code.
• Experience integrating security tooling into CI/CD (SAST/DAST/SCA).
• Strong knowledge of OWASP Top 10 and common attack vectors.
• Ability to explain security concepts to non-security stakeholders.

Responsibilities

• Launch and manage Security Champions program.
• Secure SDLC (DevSecOps): integrate security testing tools into CI/CD pipelines (e.g., Azure DevOps, Jenkins, GitLab).
• Conduct manual and automated penetration tests and code reviews on web apps, APIs, and mobile apps.
• Perform threat modeling during architecture/design phases (STRIDE/PASTA).
• Triaging results from scans, removing false positives, and creating Jira tickets for engineers.
• Create and deliver secure coding training (e.g., OWASP Top 10) tailored to tech stacks.
• Evaluate application security technologies and their reports (Stackhawk, Qualys WAS).
• Develop application security standards and coding guidelines aligned with ASVS, NIST.

Skills

Developer-Centric

Relationship Builder

Curious & Technical

Teacher & Mentor

Pragmatic

Education

Bachelor’s degree in computer science, software engineering, information security, or equivalent experience

Tools

SAST

DAST

SCA

Stackhawk

Qualys WAS

OWASP ASVS

Job description

V – Sr. Engineer: Application Security Position: Senior Security Engineer – AppSec Department: 9909153 - IT Mountain ApplicationsJob Summary: The Senior Application Security Engineer acts as the bridge between Information Security and our Software Development teams. This role is responsible for securing the Software Development Life Cycle (SDLC) by integrating security tooling directly into CI/CD pipelines and performing technical security assessments on proprietary applications.Crucially, this role is a cultural leader. You will build and nurture a \"Security Champions\" program, empowering developers to take ownership of security within their own products. You are not just finding bugs; you are teaching teams how to build secure code by design, fostering a partnership based on trust and mutual goals.Who you are:• Developer-Centric: You think like a developer because you have been one. You understand the pressure of sprint deadlines and strive to make security \"frictionless.\"• Relationship Builder: You know that the best way to secure software is to have the developers on your side. You approach vulnerability discussions with empathy and a \"how do we fix this together\" attitude.• Curious & Technical: You love digging into code logic to find the flaw that automated scanners missed.• Teacher & Mentor: You enjoy explaining why a Cross-Site Scripting (XSS) vulnerability is dangerous and demonstrating how to write the code to prevent it.• Pragmatic: You can distinguish between a theoretical risk and a practical exploit, helping business leaders make informed shipping decisions.Responsibilities include:• Security Champions Program: Help to launch, and manage a formal Security Champions program. Identify key advocates within development teams, provide them with advanced training, and build a community of practice.• Secure SDLC (DevSecOps): Engineer and maintain the integration of security testing tools (SAST, DAST, SCA) into the CI/CD pipeline (e.g., Azure DevOps, Jenkins, GitLab) to provide rapid feedback to developers.• Application Security Testing: Conduct manual and automated penetration tests and code reviews on web applications, APIs, and mobile apps prior to release.• Threat Modeling: Partner with engineering teams during the architecture/design phase to perform threat modeling (STRIDE/PASTA), identifying design flaws before code is even written.• Vulnerability Management (AppSec): Triaging results from application scans, removing false positives, and creating clear, actionable Jira tickets for engineering teams.• Developer Training: Create and deliver secure coding training (e.g., OWASP Top 10) tailored to the specific technology stacks used by the organization.• Tool Engineering: Evaluate application security technologies and their reports (e.g., Stackhawk, or Qualys WAS).• Policy & Standards: Assist in developing application security standards and coding guidelines that align with industry frameworks (ASVS, NIST). Experience you’ll need:• Bachelor’s degree in computer science, software engineering, information security, or equivalent experience.• Development Background: Significant experience in software development or scripting (e.g., Java, .NET/C#, Python, JavaScript/Node.js). You must be able to read and understand the code you are securing.• AppSec Expertise: Deep understanding of the OWASP Top 10, SANS 25, and common attack vectors (SQLi, XSS, CSRF, IDOR) and their remediations.• Pipeline Engineering: Hands-on experience integrating security tools into CI/CD pipelines (Azure DevOps, GitHub Actions, Jenkins).• Tool Proficiency: Experience with SAST (Static Analysis), DAST (Dynamic Analysis), and SCA (Software Composition Analysis) tools.• Cultural Leadership: Demonstrated experience building relationships with development teams or leading \"Security Champions\" initiatives.• API Security: Strong understanding of API security, JSON Web Tokens (JWT), and API gateways.• Communication: Ability to explain complex security exploits to non-security audiences and influence stakeholders to prioritize technical debt.• Cloud Native Security: Familiarity with securing cloud-native applications (containers, Kubernetes, Serverless) in AWS or Azure. Preferred Experience:• Certifications: CASE (Certified Application Security Engineer), CSSLP, GWEB, or OSCP (Offensive Security Certified Professional).• Experience with Qualys Web App Scanning (WAS) module.• Experience with \"Infrastructure as Code\" (IaC) security scanning (e.g., Terraform, Ansible).• Contribution to open-source security projects or bug bounty programs.