Application Security Engineer

Were embedding security and AI governance into the core of our software development lifecycle. This role owns the design and implementation of automated security scanning, code provenance, and governance processes to ensure AI-generated code meets the highest security and compliance standards.

If youre a self-driven engineer who enjoys building security automation from the ground up and weaving security seamlessly into development pipelines, this role is for you.

About The Role

Job Title: AppSec / AI Security Engineer (4 to 8 years)

Employment Type: Full-time/ Permanent

Location: Indore (Work from Office)

Key Responsibilities

• Build and integrate security controls into CI/CD pipelines including automated scanning for source code, dependencies, secrets, and Infrastructure as Code (IaC) with enforcement gates on every merge.
• Design and implement code provenance tracking to capture AI-generated code, the AI models used, and reviewer approvals as part of the development pipeline.
• Develop structured code review workflows incorporating specifications, scan results, and code provenance.
• Optimize security scanning tools to reduce false positives and drive developer adoption.
• Investigate and manage security findings using established remediation and documentation processes.
• Contribute to AI governance standards, including secure usage of AI tools and governance of AI-generated code.
• Conduct independent security reviews of internally developed, third-party, and vendor-supplied code to ensure compliance with security standards.

• Strong hands-on experience in Application Security, with proven expertise securing CI/CD pipelines.
• Experience implementing automated security scanning and enforcement not just operating existing tools.
• Strong knowledge of SAST, SCA, secret scanning, DAST, and IaC security scanning.
• Strong understanding of cloud infrastructure, with hands-on or working knowledge of AWS and Azure, is preferred.
• Ability to design, build, and own security automation and governance solutions from the ground up.
• Strong judgment in balancing security with developer productivity by minimizing unnecessary alerts.
• Excellent communication skills, with the ability to explain security risks in clear, business-friendly language.
• Strong analytical mindset and ability to independently assess security risk across internal and external codebases.

• 4 to 8 years of experience in Application Security, Security Engineering, DevSecOps, or a related field.
• Experience with AI-generated code security, LLM security risks, prompt injection, code provenance, or AI governance.
• Hands-on experience with tools such as Semgrep, CodeQL, Snyk, Gitleaks, TruffleHog, Prowler, Trivy, or similar.
• AWS certification (Solutions Architect Associate preferred), or willingness to obtain one within 90 days.
• Security certifications such as OSCP, GWAPT, CSSLP, or equivalent.
• Experience writing custom detection rules or security policies (e.g., custom Semgrep rules).

This job is provided by Shine.com