Application Security Engineer-1

<p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-weight:bolder;"><span style="font-family:Arial;">Location:</span></span><span style="font-family:Arial;"> Bangalore/Mumbai</span><br /><span style="font-weight:bolder;"><span style="font-family:Arial;">Function:</span></span><span style="font-family:Arial;"> Application Security</span><br /><span style="font-weight:bolder;"><span style="font-family:Arial;">Experience:</span></span><span style="font-family:Arial;"> 2+ years</span></font></p><h2 style="margin-top:0px;margin-bottom:0.5rem;color:rgb(19,19,19);font-size:2rem;"><font color="#000000"><span style="font-family:Arial;font-size:18px;"><span style="font-family:DarwinSans, 'Noto Sans Variable';font-weight:bolder;">About Upstox</span></span></font></h2><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">At Upstox, we’re building the future of investing — simple, powerful, and for everyone. We're one of India’s fastest-growing fintech platforms, backed by the best in the business, including Mr. Ratan Tata and Tiger Global, and on a mission to make wealth creation accessible to every Indian. From first-time investors to seasoned traders, millions trust us to power their financial journeys. We're not just moving fast — we're moving with purpose. If you thrive in a high-energy, high-impact environment, you're in the right place.</span></font></p><h2 style="margin-top:0px;margin-bottom:0.5rem;color:rgb(19,19,19);font-size:2rem;"><font color="#000000"><span style="font-family:Arial;font-size:18px;"><span style="font-family:DarwinSans, 'Noto Sans Variable';font-weight:bolder;">The Role: Security Engineer 1 — Application Security</span></span></font></h2><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">You'll join the Application Security team and work hands-on to secure Upstox’s web, mobile, and API surfaces. You’ll be involved across the security lifecycle — from penetration testing and source code reviews to threat modelling, cloud security, and embedding security practices into the software development lifecycle.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">This is a role for someone with a strong offensive security foundation who enjoys understanding how products and systems work, finding weaknesses, and working with engineering teams to fix them. You’ll have the opportunity to work closely with engineering teams and contribute to building secure products at scale.</span></font></p><h2 style="margin-top:0px;margin-bottom:0.5rem;color:rgb(19,19,19);font-size:2rem;"><font color="#000000"><span style="font-family:Arial;font-size:18px;"><span style="font-family:DarwinSans, 'Noto Sans Variable';font-weight:bolder;">What You’ll Own</span></span></font></h2><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Perform penetration testing across web applications, mobile applications (Android/iOS), and APIs to identify vulnerabilities before they reach production.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Conduct manual and tool-assisted source code reviews to identify security vulnerabilities early in the development lifecycle.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Partner with engineering teams to embed security into the Secure SDLC, including security requirements, design reviews, and release gating.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Drive and participate in threat modelling exercises for new features and systems.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Configure, tune, and manage WAF rules across Cloudflare and AWS WAF to protect production applications and APIs.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Write, maintain, and improve scripts and security tools to automate security testing and streamline recurring security assessments.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Work with cloud infrastructure, preferably AWS, to review configurations and identify potential security gaps.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Track identified vulnerabilities through remediation and work closely with engineering teams to ensure vulnerabilities are addressed within defined SLAs.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Stay current with the evolving threat landscape, emerging vulnerabilities, new attack techniques, and application security tooling.</span></font></p><h2 style="margin-top:0px;margin-bottom:0.5rem;color:rgb(19,19,19);font-size:2rem;"><font color="#000000"><span style="font-family:Arial;font-size:18px;"><span style="font-family:DarwinSans, 'Noto Sans Variable';font-weight:bolder;">What We’re Looking For:</span></span></font></h2><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● 2+ years of hands-on experience in application or product security.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Strong hands-on experience in penetration testing of web applications, mobile applications, and APIs.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Strong hands-on experience with manual and/or tool-assisted source code review.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Proficiency in at least one programming language: Python, Go, or Rust.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Working understanding of at least one cloud platform, preferably AWS.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Practical exposure to Secure SDLC and threat modelling practices.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Understanding of authentication and authorization protocols such as SAML, OAuth, and OIDC.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Understanding of software supply chain security concepts.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Experience working with Cloudflare and/or AWS WAF.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● A strong learning mindset and genuine curiosity to explore new tools, techniques, and areas of application security.</span></font></p><h2 style="margin-top:0px;margin-bottom:0.5rem;color:rgb(19,19,19);font-size:2rem;"><font color="#000000"><span style="font-family:Arial;font-size:18px;"><span style="font-family:DarwinSans, 'Noto Sans Variable';font-weight:bolder;">Good to Have:</span></span></font></h2><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Basic understanding of container security fundamentals, including Docker and Kubernetes.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Exposure to DevSecOps practices and integrating security into CI/CD pipelines.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Relevant certifications such as OSCP, OSWE, OSCE, or CEH are a plus but not mandatory.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">● Bug bounty experience is a plus but not mandatory.</span></font></p><h2 style="margin-top:0px;margin-bottom:0.5rem;color:rgb(19,19,19);font-size:2rem;"><font color="#000000"><span style="font-family:Arial;font-size:18px;"><span style="font-family:DarwinSans, 'Noto Sans Variable';font-weight:bolder;">Why This Role Rocks:</span></span></font></h2><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">You'll be part of a high-impact Application Security team working on high-scale, high-stakes financial products used by millions of users. You’ll get direct exposure to modern application, cloud, mobile, and API security challenges while working closely with engineering teams to build security into products from the ground up.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">You won't just identify vulnerabilities — you'll help engineering teams fix them, improve security practices, automate recurring security work, and contribute to making the products and systems powering Upstox more secure.</span></font></p><p style="margin-bottom:1rem;color:rgb(19,19,19);"><font color="#000000"><span style="font-family:Arial;">By applying for this position, you acknowledge that you have reviewed our Prospective Employee Privacy Notice, which outlines how Upstox collects, uses, and protects your Personal Information ("PI"). I accept Upstox's</span><a href="https://assets.upstox.com/files/privacy-policy/prospective-employee-privacy-notice.pdf" style="text-decoration:underline;" target="_blank" rel="noreferrer noopener"><u><span style="font-family:Arial;">Prospective Employee Privacy Notice</span></u></a><u><span style="font-family:Arial;">.</span><br /></u></font><span style="font-family:Arial;background-color:transparent;color:rgb(0,0,0);font-size:10pt;white-space:pre-wrap;">Upstox is an Equal Opportunity Employer; all qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, veteran status, or other characteristics.</span></p>