Senior Application Security Engineer

About the job

We are looking for an Application Security Engineer in the AppSec team.

As a Senior Application Security Engineer at inDrive, you will own whole areas of our AppSec program, from security requirements and design reviews to controls that work in production. You will work with product, platform and infrastructure teams on new architecture, AI systems and the security of our apps and services. The role fits a hands-on engineer who reviews code and architecture, leads work across several teams and makes security decisions based on data.

• Own one or more areas of the AppSec program end to end, including the plan, the risks and the metrics.
• Run security design reviews and threat modeling of new features, services and AI systems, and defend security requirements at the architecture committee.
• Assess the security of web, mobile and API applications and find variants of confirmed vulnerabilities across other services.
• Coordinate external security assessments and bug bounty findings, from triage and prioritisation with teams to fix verification.
• Design secure authentication and authorization between users, services and internal tools together with platform teams.
• Choose, pilot and tune security tools, and keep only those that pay off in real findings.
• Turn incidents and assessment results into lasting controls, policies and secure defaults for developers.
• Consult development teams on complex security issues and take shifts in AppSec duty for Critical and High incidents.

• Higher education in IT, preferably in information security.
• Knowledge of mobile application security on Android and iOS, client-server trust, app integrity and protection against bots and account takeover.
• Deep knowledge of web and API security, including authentication and authorization flaws, SSRF, injections and business logic issues, and the ability to find variants of a vulnerability class across many services.
• Strong understanding of identity and access, OAuth 2.0, OIDC, JWT, signing key rotation, mTLS, service-to-service authentication and SSO.
• Understanding of security risks of AI systems and LLM agents, such as prompt injection, excessive tool permissions and agent access to sensitive data, and practical use of AI in your own security work.
• Practical understanding of cloud-native infrastructure, Kubernetes, containers, API gateways and AWS.
• Experience in threat modeling and security design review of new features and architecture.
• Understanding of vulnerability management and risk, including severity, SLA, compensating controls and risk acceptance.
• Ability to read and review code in at least one language, preferably Golang.
• Track record of leading projects with two or more teams from a requirement to a verified fix, and clear written English.
• Experience with secrets and key management, rotation and response to credential leaks.
  

Nice to have

• Knowledge of software supply chain security, dependencies, CI/CD pipelines and source control platform hardening.
• Experience tuning SAST, DAST and SCA tools for precision and judging a tool by noise and cost per real finding.