Application Security / AppSec Engineer

Project overview

This contract role sits in the Risk Consulting Cyber practice, supporting financial-services security work from the Bengaluru Millenia location; the work mode is not specified. The engineer will establish and operate secure SDLC practices, embed automated security testing in CI/CD, review architecture and threat models, and help teams remediate application and API risks across cloud-native environments.

Key requirements include 5–8+ years of relevant experience, OWASP and API security knowledge, hands-on SAST/DAST/SCA pipeline integration, CI/CD familiarity, container and Kubernetes security, a coding or scripting background, and exceptional written and spoken English. Preferred qualifications include CSSLP, GWAPT, OSCP, CEH, or equivalent certifications; experience securing AI-enabled applications is also mentioned as an area of support.

The structured input gives an experience band of 5–9 years, while the description specifies 5–8+ years; this discrepancy is noted, and the broader structured band is retained for sourcing.

Responsibilities

• Secure SDLC Governance: Establish, mature, and evangelize secure SDLC practices across engineering teams.
• DevSecOps Integration: Seamlessly integrate SAST, DAST, SCA, secrets scanning, and container security tools into CI/CD pipelines.
• Threat Modeling & Architecture: Conduct thorough application threat modeling and security architecture reviews for complex software designs.
• Vulnerability Mitigation: Identify and remediate vulnerabilities mapped to the OWASP Top 10 and critical API security risks.
• Lifecycle Management: Manage the end-to-end application vulnerability lifecycle, triage findings, and drive prompt remediation.
• CI/CD Quality Gates: Define automated security gates and implement risk-based vulnerability prioritization metrics within deployment pipelines.
• Penetration Testing Support: Support internal and external penetration testing efforts and validate the remediation of discovered findings.
• Supply Chain Security: Establish robust software supply-chain security controls, dependency tracking, and artifact integrity checks.
• Container & Cloud Security: Provide security guidance for container images, registries, and Kubernetes deployments.
• Standards & Enablement: Develop AppSec standards, code policies, and developer guidance; deliver developer security training and enablement.
• Emerging Tech: Support the secure design and deployment of AI-enabled applications.
• Experience: 5 to 8+ years of hands-on experience in application security, product security, or software engineering with a strong security focus.

Requirements

• Application security and secure SDLC practices
• OWASP Top 10, OWASP API Security Top 10, and secure coding
• Hands-on SAST, DAST, and SCA tooling
• CI/CD security integration and version-control platforms
• Application threat modeling and security architecture reviews
• Application vulnerability triage, prioritization, and remediation
• Container, Kubernetes, and API gateway security
• Software development or scripting skills for code review and automation
• Exceptional written and verbal English communication

Project details

• Start: flexible
• Remote: onsite
• Location: India, IN