Application & AI Security Engineer

Location: Bengaluru, India

Department: Technology

Experience: 4-6

• Conduct penetration testing on web applications, APIs, networks, and cloud environments (Google Cloud Platform).
• Perform manual and automated security testing of web applications, APIs, AI agents, LLM applications, chatbots, and RAG systems.
• Identify issues such as broken authentication and authorization, injection, business-logic flaws, prompt injection, jailbreaks, excessive agency, sensitive-data leakage etc. and insecure tool use.
• Identify, exploit, and document security flaws and misconfigurations.
• Prepare detailed technical reports and executive summaries for stakeholders.
• Contribute to improving internal security testing processes and automation.

• Assess application, cloud, and infrastructure vulnerabilities; prioritize findings by severity, exploitability, and business impact.
• Support threat modeling, secure design reviews, and integration of security testing into the SDLC/DevOps process.
• Collaborate with development and infrastructure teams to remediate identified vulnerabilities.
• Stay updated on the latest exploits, vulnerabilities (CVEs), and industry trends.

• Use SIEM platforms such as Wazuh or other open-source SIEM solutions to monitor logs, triage alerts, and investigate suspicious security activity.
• Support detection-rule tuning, incident investigations, and mapping relevant techniques to MITRE ATT&CK.

• GCP configurations, IAM permissions, network exposure, storage access, secrets handling, and container security basics.

• 4–6 years of hands-on experience in application security, penetration testing, or offensive security. Strong understanding of web/API security, OWASP Top 10, authentication, authorization and common application vulnerabilities.
• Practical understanding of AI/LLM security, including prompt injection, data leakage, and AI agent/tool risks.
• Strong understanding of OWASP Top 10, MITRE ATT&CK, and other industry standards.
• Proficiency in tools like Burp Suite, Metasploit, Nmap, Wireshark, Nessus, Nikto, SQLmap.
• Hands-on experience with scripting languages such as Python, Bash.
• Exposure to SIEM operations, log analysis, alert triage
• Understanding of Secure SDLC and DevOps principles.

• OSCP, PNPT, eCPPT, Burp Suite Certified Practitioner, or relevant AI security training.
• CPT (Certified Penetration Tester)
• GPEN (GIAC Penetration Tester)
• CRTP / CRTE / PNPT / eJPT / eCPPT (as relevant)

• Strong analytical and problem-solving skills.
• Excellent communication skills—able to explain technical details to non-technical stakeholders.
• Team player with the ability to work independently under minimal supervision.
• Attention to detail and ability to document findings clearly.

• An opportunity to be part of some of the best enterprise SaaS products to be built out of India.
• Opportunities to quench your thirst for problem-solving, experimenting, learning, and implementing innovative solutions.
• A flat, collegial work environment, with a work hard, play hard attitude.
• A platform for rapid growth if you are willing to try new things without fear of failure.
• Remuneration with best-in-class industry standards with generous health insurance cover

• Ranked as one of America's Fastest-Growing Companies by Financial Times for five consecutive years: 2020-2024.
• Ranked as one of America's Fastest-Growing Private Companies by Inc. 5000 for seven consecutive years: 2018-2024.
• Voted #1 by more than 300 retailers worldwide in the RIS Software LeaderBoard 2024 report.
• Ranked #72 in America’s Most Innovative Companies list in 2023—by Fortune—alongside companies like Microsoft, Tesla, Apple, IBM, etc.
• Forged a strategic partnership with Google to equip retailers with cutting-edge generative AI tools.
• Recognized in multiple Gartner reports, including Market Guides and Hype Cycle, spanning assortments, merchandising, forecasting, algorithmic retailing, Unified Price, Promotion, and Markdown Optimization Applications.