Sr. Engineer: Application Security

Concentrix Catalyst Technologies Private Limited; Telangana; On-site; INR 1,500,000 - 2,100,000; Full time

Job summary

Concentrix Hyderabad is seeking a Sr. Engineer: Application Security to bridge Information Security and software development, embedding security into the SDLC and CI/CD pipelines.

You will lead a Security Champions program, train developers, and foster secure coding practices across web, API, and mobile apps. The role requires a developer background, deep AppSec expertise, and the ability to influence product teams toward secure shipping.

Qualifications

• Bachelor's degree in computer science, software engineering, information security, or equivalent.
• Development background with ability to read code
• Deep understanding of OWASP Top 10 and common web app vulnerabilities
• Experience integrating security tools into CI/CD pipelines
• Ability to lead Security Champions initiatives
• Strong communication to explain security to non-security teams
• Knowledge of cloud-native security (containers, Kubernetes)
• Familiarity with API security and JWT

Responsibilities

• Launch and manage a formal Security Champions program.
• Integrate security testing tools into CI/CD pipelines.
• Conduct manual and automated security testing of apps.
• Perform threat modeling during design phases.
• Triaging results and creating Jira tickets for fixes.
• Deliver secure coding training for developers.
• Evaluate security technologies and reports.
• Develop security standards and guidelines.

Skills

Developer mindset

Security champion

Vulnerability remediation

Security communication

DevSecOps integration

Education

Bachelor's degree in Computer Science or equivalent

Tools

SAST tools

DAST tools

SCA tools

Azure DevOps

Jenkins

GitHub Actions

Qualys WAS

Terraform

Ansible

Job description

Job Title: Sr. Engineer: Application Security

Job Description We're Concentrix. The intelligent transformation partner. Solution-focused. Tech-powered. Intelligence-fueled. The global technology and services leader that powers the world’s best brands, today and into the future. We’re solution-focused, tech-powered, intelligence-fueled. With unique data and insights, deep industry expertise, and advanced technology solutions, we’re the intelligent transformation partner that powers a world that works, helping companies become refreshingly simple to work, interact, and transact with. We shape new game-changing careers in over 70 countries, attracting the best talent. The Concentrix Technical Products and Services team is the driving force behind Concentrix’s transformation, data, and technology services. We integrate world‑class digital engineering, creativity, and a deep understanding of human behavior to find and unlock value through tech‑powered and intelligence‑fueled experiences. We combine human‑centered design, powerful data, and strong tech to accelerate transformation at scale. You will be surrounded by the best in the world providing market leading technology and insights to modernize and simplify the customer experience. Within our professional services team, you will deliver strategic consulting, design, advisory services, market research, and contact center analytics that deliver insights to improve outcomes and value for our clients. Hence achieving our vision. Our game‑changers around the world have devoted their careers to ensuring every relationship is exceptional. And we’re proud to be recognized with awards such as "World’s Best Workplaces," “Best Companies for Career Growth,” and “Best Company Culture,” year after year. Join us and be part of this journey towards greater opportunities and brighter futures.

V – Sr. Engineer: Application Security

Position: Senior Security Engineer – AppSec Department:

9909153 - IT Mountain Applications

Job Summary

The Senior Application Security Engineer acts as the bridge between Information Security and our Software Development teams. This role is responsible for securing the Software Development Life Cycle (SDLC) by integrating security tooling directly into CI/CD pipelines and performing technical security assessments on proprietary applications. Crucially, this role is a cultural leader. You will build and nurture a "Security Champions" program, empowering developers to take ownership of security within their own products. You are not just finding bugs; you are teaching teams how to build secure code by design, fostering a partnership based on trust and mutual goals.

Who you are

• Developer-Centric: You think like a developer because you have been one. You understand the pressure of sprint deadlines and strive to make security "frictionless."
• Relationship Builder: You know that the best way to secure software is to have the developers on your side. You approach vulnerability discussions with empathy and a "how do we fix this together" attitude.
• Curious & Technical: You love digging into code logic to find the flaw that automated scanners missed.
• Teacher & Mentor: You enjoy explaining why a Cross-Site Scripting (XSS) vulnerability is dangerous and demonstrating how to write the code to prevent it.
• Pragmatic: You can distinguish between a theoretical risk and a practical exploit, helping business leaders make informed shipping decisions.

Responsibilities include

• Security Champions Program: Help to launch, and manage a formal Security Champions program. Identify key advocates within development teams, provide them with advanced training, and build a community of practice.
• Secure SDLC (DevSecOps): Engineer and maintain the integration of security testing tools (SAST, DAST, SCA) into the CI/CD pipeline (e.g., Azure DevOps, Jenkins, GitLab) to provide rapid feedback to developers.
• Application Security Testing: Conduct manual and automated penetration tests and code reviews on web applications, APIs, and mobile apps prior to release.
• Threat Modeling: Partner with engineering teams during the architecture/design phase to perform threat modeling (STRIDE/PASTA), identifying design flaws before code is even written.
• Vulnerability Management (AppSec): Triaging results from application scans, removing false positives, and creating clear, actionable Jira tickets for engineering teams.
• Developer Training: Create and deliver secure coding training (e.g., OWASP Top 10) tailored to the specific technology stacks used by the organization.
• Tool Engineering: Evaluate application security technologies and their reports (e.g., Stackhawk, or Qualys WAS).
• Policy & Standards: Assist in developing application security standards and coding guidelines that align with industry frameworks (ASVS, NIST).

Experience you’ll need

• Bachelor’s degree in computer science, software engineering, information security, or equivalent experience.
• Development Background: Significant experience in software development or scripting (e.g., Java, .NET/C#, Python, JavaScript/Node.js). You must be able to read and understand the code you are securing.
• AppSec Expertise: Deep understanding of the OWASP Top 10, SANS 25, and common attack vectors (SQLi, XSS, CSRF, IDOR) and their remediations.
• Pipeline Engineering: Hands‑on experience integrating security tools into CI/CD pipelines (Azure DevOps, GitHub Actions, Jenkins).
• Tool Proficiency: Experience with SAST (Static Analysis), DAST (Dynamic Analysis), and SCA (Software Composition Analysis) tools.
• Cultural Leadership: Demonstrated experience building relationships with development teams or leading "Security Champions" initiatives.
• API Security: Strong understanding of API security, JSON Web Tokens (JWT), and API gateways.
• Communication: Ability to explain complex security exploits to non‑security audiences and influence stakeholders to prioritize technical debt.
• Cloud Native Security: Familiarity with securing cloud‑native applications (containers, Kubernetes, Serverless) in AWS or Azure.

Preferred Experience

• Certifications: CASE (Certified Application Security Engineer), CSSLP, GWEB, or OSCP (Offensive Security Certified Professional).
• Experience with Qualys Web App Scanning (WAS) module.
• Experience with "Infrastructure as Code" (IaC) security scanning (e.g., Terraform, Ansible).
• Contribution to open‑source security projects or bug bounty programs.

Location

IND Hyderabad Raidurg Village B7 South Tower, Serilingampally Mandal Divya Sree Orion Language Requirements: Time Type: Full time

Mission

Hi, we're Concentrix. We’re a global technology and services leader that powers the brands of the future. We help well‑known brands — the ones you use every day — improve their businesses with technology and integrated solutions, in over 70 countries. Company Overview: We power the brands of the future. Some call us a global technology and services leader. But we’re so much more. Human‑centered, tech‑powered, intelligence fuelled. Every day we’re busy helping over 2000 of the world's best brands solve their toughest business challenges. Whether it’s... designing game‑changing brand experiences, building and scaling secure AI technologies, or building loyalty to drive revenue. We’ve got them covered. But how? We design, build, and run fully integrated, end‑to‑end solutions across the entire enterprise, at speed and scale. We’re the strategic thinkers who designbrand‑defining experiences. The technologists & engineers who buildsmarter solutions. And the operational experts who run it all and make it work seamlessly. By integrating strategy & design with data & analytics, enterprise technology, and digital operations. You could say, at the heart of everything we do lies a commitment to transform the way companies connect, interact, and grow across the world and into the future. Experience the power of Concentrix.

Concentrix CVG Corporation is an EEO/AA/M/F/Vet/Disability Employer.