Senior Application Security Engineer
One Identity
IndiaremotePosted 16 days ago
Skill Required
Application-Security-EngineerSecurity-EngineerProduct-Security-EngineerSoftware-Security-EngineerCybersecurity-EngineerSenior-Application-Security-EngineerLead-Application-Security-EngineerSenior-Information-Security-EngineerApplication-Security-ArchitectApplication-Security-LeadSenior-Cybersecurity-EngineerSecurity EngineerApplication Developersecuritysoftware engineeringOWASPEngineeringbuildingISO 27001Embedded CTestNGdesign.NETOAuthJavaIAMC#andAIFulltime
Key highlights
- Minimum 6 years experience in software engineering or security, with at least 3 years focused on application/product security.
- Code‑level fluency in C#/.NET and ability to work effectively in Java codebases.
- Hands‑on experience with AI‑assisted development or AI‑enabled security tooling within the last 6 months.
- Health and wellness are a priority for employees.
- Career development programs and investment in people.
- Role is embedded within engineering, giving direct impact on product security.
Role overview
Senior Application Security Engineer at One Identity, an individual contributor role based in India reporting to the Director of Information Security. The role is embedded within engineering to bring security earlier in the development lifecycle, focusing on threat modeling, secure coding, vulnerability response, and providing security evidence for products.
Responsibilities
- Threat model the things that matter: authentication and session handling, privilege elevation paths, connector and integration boundaries, tenant isolation in hosted offerings, and cryptographic and secrets handling. You choose where the depth goes.
- Set security requirements early enough to shape a design instead of contesting one. Engineering teams should meet you at the architecture stage, not at the release gate.
- Give product and engineering leadership a defensible read on which risks are worth carrying, in language a release decision can be made from.
- Hold commit access to product repositories. A dependency bump, a patched library, a fix in the code path that produced the finding: submit it, review it, and pair with the engineer who owns that module. PRs, not tickets.
- Own static analysis, dependency scanning, and dynamic testing across the product lines. Tune them until the signal is worth the interruption, and route findings to the team that can act on them.
- Raise the ceiling on secure coding across a large .NET and Java codebase: patterns, libraries, and reference implementations that make the safe approach the convenient one, plus the review depth to know when they're being used correctly.
- Take a position on AI‑assisted development. Engineering is generating code with it, and someone needs to decide what review that code gets, where automated remediation is trusted to open a pull request, and how we verify what it changed.
- Own product vulnerability response end to end: intake from researchers and customers, triage across affected versions, coordinated disclosure, CVE handling, and the advisory customers actually read.
- Turn penetration test and bug bounty findings into fixes and into the systemic change that prevents the next one. Recurrence is the signal that a control is missing, not that a bug was missed.
- Own software composition analysis and SBOM generation across the product lines, including the license and provenance data Legal and customers depend on.
- Make product security evidence available on demand. Customer questionnaires, security reviews, and certification work all draw on the same underlying facts, and they should be produced from one source.
Requirements
- Six or more years in software engineering or security, with at least three focused on application or product security. Equivalent depth counts.
- Application security experience on a product that customers deploy and operate themselves, with the release and disclosure realities that come with it.
- Code‑level fluency in C# and .NET, and enough range to be useful in a Java codebase. You read and write production code, not just findings.
- Hands‑on work with AI‑assisted development or AI‑enabled security tooling within the last six months, and a considered view on where it belongs in a review pipeline.
Nice to have
- Threat modeling at design time with engineering in the room
- Static, dynamic and composition analysis tooling and the judgment to tune it
- Identity and authentication protocols including OAuth, OIDC, SAML and SCIM
- Coordinated vulnerability disclosure and CVE handling
- Secure code review depth in web and API surfaces
- Ability to hold a position with senior engineers and change it when they're right
- SBOM standards and license compliance
- Cryptographic review
- Security champions programs
- PCI DSS or FedRAMP applied to a product rather than a company
- Prior time as a product engineer
Benefits
- Collaborating with dedicated professionals who have a passion for technology
- Opportunity to invent solutions when improvements are identified
- Positive and meaningful relationships within a winning culture
- Investment in people through programs that enable career growth and fulfillment
- Health and wellness are a priority for employees
- Rewarding employees for their hard work
- Equal Opportunity Employer with a commitment to a discrimination‑free workplace
Additional details
- Our products are the access control layer for the companies that buy them. Identity Manager, Active Roles, Safeguard and OneLogin decide who gets into everything else a customer runs.
- Much of what we build is deployed by customers in their own datacenters. When a defect ships, remediation moves at their upgrade cadence, not ours.
- We are separating from Quest Software and building an independent security function; the team is lean and globally distributed.
- The role serves as the security voice in the product organization, with scope coming from what is built into the development lifecycle and what engineering adopts.
- This role is embedded in engineering by design, with access to prove it, working across every product line, requiring breadth before depth.
- Company description: One Identity enables organizations of all sizes to better secure, manage, monitor, protect, and analyse information and infrastructure to help fuel innovation and drive their businesses forward.
- When you join, you will have the opportunity to build and develop products at a scale few others can provide.
- One Identity is an Equal Opportunity Employer and prohibits discrimination and harassment of any kind.
- Note: We do not use text messaging or third‑party messaging apps like Telegram to communicate with applicants; only interact with contacts that have an @oneidentity.com email address.
- Originally posted on Himalayas.