Juniper Square - Senior Engineer - Application and Platform Security (India)
Requirements
• Experience: 5+ years in application or product security, or in software engineering with a strong security focus. • Code review: Deep experience finding vulnerabilities through manual review. You find authorization and business logic flaws by reading code, not only by running a scanner. • Programming: Strong Python, plus working proficiency in JavaScript/TypeScript, enough to review front-end code for client-side issues. You write production-quality code, not just scripts. • Identity: In-depth knowledge of OAuth 2.0/OIDC, SAML, MFA, session management, and access control models, with hands-on experience implementing them securely. • Threat modeling: Experience leading threat modeling sessions with engineering teams and turning the output into concrete requirements. • Security tooling: Experience running and tuning SAST, SCA, and DAST, including writing custom rules. • Platform awareness: Working knowledge of cloud, container, and CI/CD security, enough to reason about how application design interacts with infrastructure. • AI security: A working understanding of LLM application risks and the drive to go deep. • Collaboration: Clear writing and a track record of influencing engineering teams without becoming a bottleneck. • An offensive web security background, such as bug bounty, web application CVEs, or CTFs. Certifications like OSWE or BSCP are a plus, not a requirement. • Experience building developer-facing security tooling or libraries. • Experience building or running a security champions program. • Familiarity with OWASP ASVS or the OWASP Top 10 for LLM Applications.
Responsibilities
• Application and product security (your focus) • Lead security design reviews and threat models for new product features, with depth in authentication, authorization, data isolation, and high-risk financial workflows. • Perform manual code review and security testing of web applications and APIs. Focus on the authorization and business logic flaws that scanners miss, and drive fixes through to verification. • Design secure-by-default libraries, framework-level controls, and custom static analysis rules that eliminate whole classes of vulnerabilities. • Triage application findings from automated and manual testing and external assessments. Group them by root cause and write remediation guidance engineers can act on. • Threat-model and test AI-powered product features against risks like prompt injection, unsafe tool use, data leakage, and excessive agency. Define secure patterns other teams can reuse. • Support our external penetration testing program, from scoping through retest. • Partner with teammates on build pipeline and supply-chain security, especially dependency risk in application code. • Participate in incident response for application security events. • Build security automation and agents that cut review and triage time.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT