application security developer

Instabug

<div><p><b>Job Purpose<br>
</b><br>
<br>
</p><p>As an Application Security Engineer at Luciq, you will help shape and build our application security program alongside the wider team. This is a hands-on, high-ownership role where you will work closely with product and development teams across the full software development lifecycle &mdash; reviewing designs before code is written, identifying risks as features take shape, and ensuring security is embedded into how we build and ship software, not bolted on after the fact. Our stack runs on Ruby on Rails, Go, and Python, deployed on AWS with Terraform managing infrastructure as code and Jenkins powering CI/CD. You will read and review code in these languages &mdash; not just rely on scanner output &mdash; and work with AWS security services (SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront) to provide visibility and protection across our infrastructure. The role spans web applications, APIs, our mobile SDK (iOS and Android), cloud, and CI/CD &mdash; partnering with engineers, PMs, Platform, and the Security team to make the secure path the default path. This role can be filled at mid-level with a clear growth path to senior-level as you grow into shaping our application security program, or at senior-level if you're already operating at that scope.
</p><p>You will join a lean Security team, which entails stepping beyond core AppSec for incident triage, addressing customer security questionnaires, or supporting cross-functional cloud and compliance reviews. We value this variety as a core facet of the role; if you are seeking hyper-specialized work restricted strictly to application security, this may not be the right fit.<br>
</p><p></p><br>
<br>
<p>Job Responsibilities
</p><ul><li><b>Secure Design &amp; Code Review
</b></li></ul><ul><li><div><ul><li>Run and lead threat modeling sessions with product and engineering teams during feature design. This is a hands-on role with expectations to deliver fixes in the product as needed while enabling other engineers.
</li><li>Conduct security code reviews and architecture reviews across web applications, APIs, and services in Ruby, Go, and Python
</li><li>Leverage AI and make sure that we enable engineers to adhere to security acceptance criteria. Provide guidance to engineers on secure design as we iterate and build the product.
</li></ul></div></li></ul><ul><li><b>Vulnerability Management
</b></li></ul><ul><li><div><ul><li>Validate, triage, and drive remediation of vulnerabilities &mdash; partner with engineering teams across the full lifecycle from discovery through SLA support
</li><li>Coordinate with engineering teams on fix verification and root-cause prevention
</li></ul></div></li></ul><ul><li><b>Security Automation in CI/CD
</b></li></ul><ul><li><div><ul><li>Build and maintain automated security testing in CI/CD &mdash; SAST, SCA, secret scanning
</li><li>Tune tooling for signal over noise; integrate findings into developer workflows
</li><li>Operate secret-scanning and leaked-credential response workflows
</li></ul></div></li></ul><ul><li><b>Cloud &amp; Infrastructure Security
</b></li></ul><ul><li><div><ul><li>Support cloud security reviews &mdash; IAM policies, network segmentation, container/Kubernetes configurations, and Terraform policy-as-code
</li><li>Work with AWS security services (SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront) to maintain visibility and detection across our infrastructure
</li></ul></div></li></ul><ul><li><b>Supply Chain &amp; Build Security
</b></li></ul><ul><li><div><ul><li>Own dependency risk via SCA, lockfiles, and pinning
</li><li>Drive CI/CD pipeline hardening &mdash; build runners, OIDC-to-cloud, artifact signing, SBOM standards
</li></ul></div></li></ul><ul><li><b>Cross-functional Security Enablement
</b></li></ul><ul><li><div><ul><li>Develop secure coding guidelines and reusable patterns that make the secure path the default
</li><li>Drive S-SDLC adoption across engineering teams
</li><li>Review security posture of our mobile SDK across iOS and Android &mdash; data handling, transport security, local storage, IPC, encryption, third-party dependency risk, and SDK consumer-facing security defaults
</li><li>Assess security risks in AI/LLM integrations &mdash; prompt injection, insecure output handling, trust boundaries in agentic architectures
</li><li>Support compliance initiatives (SOC 2, ISO 27001) &mdash; translate control requirements into engineering practices and assist with audit evidence collection
</li>Use AI tooling actively in your own workflow AI-assisted code review, threat modeling drafts, vulnerability research, and security artifact generation and help shape how the rest of engineering uses AI safely<br>
<li>
</li></ul></div></li></ul><p></p><br>
<br>
<p><b>Job Requirements<br>
</b></p><p></p><br>
<p><b>Must-Haves
</b></p><ul><li><b>Experience </b>: 3-6 years in application security, or security engineering
</li><li><b>Education </b>: Bachelor's degree in Computer Science, Information Security, or equivalent practical experience
</li><li><b>Secure code review </b>in at least one of: Python, Ruby, Go &mdash; can read code and reason about vulnerabilities, not rely on scanner output
</li><li><b>OWASP Top 10 (Web and API) </b>as root-cause patterns, not a memorized checklist &mdash; including SSRF, insecure deserialization, injection classes, and access-control flaws
</li><li><b>Threat modeling </b>: practical experience with STRIDE and data flow diagrams; can lead a session with a product team and produce actionable output
</li><li><b>Auth and identity </b>: working depth in session management, RBAC/ABAC models
</li><li><b>CI/CD security automation </b>: hands-on experience integrating SAST, SCA, and secret scanning into pipelines and tuning for actionable signal
</li><li><b>Proactive and ownership-driven </b>&mdash; does not wait to be told what to secure
</li><li>Comfortable working <b>cross-functionally </b>with product engineers, platform engineers, and the wider team
</li><li>Strong <b>analytical and problem-solving </b>abilities
</li><li>Fluent in <b>English </b>, with strong written and verbal communication
<br>
</li><li><b>Communication </b>: clear written and verbal communication can explain a vulnerability to an engineer, a PM, or a VP<br>
<br>
<br>
</li></ul><p><b>Strong Plus
</b></p><p>We expect strong candidates to have <i>some </i>of these not all. The more, the better.
</p><ul><li><b>Mobile SDK security </b>: OWASP Mobile Top 10 and MASVS/MASTG; Android (Kotlin) or iOS (Swift); experience with Frida, objection, or MobSF
</li><li><b>AWS security service depth </b>: SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront beyond IAM
</li><li><b>Container and Kubernetes </b>security fundamentals
</li><li><b>Supply chain depth </b>: SLSA framework, SBOM <b>AI/LLM security </b>: prompt injection mitigations, OWASP LLM Top 10, securing agentic architectures and tool-use boundaries
</li><li>Familiarity with <b>ISO 27001 or SOC 2 </b>.<br>
<br>
<br>
</li></ul><p><b>Nice to Have
</b></p><ul><li>Terraform and policy-as-code: tfsec, Checkov, OPA/Conftest
</li><li>Experience building or bootstrapping a security program
</li><li>Bug bounty participation, published CVEs, or documented security research
</li><li>Hands-on certifications: OSCP, OSWE, eMAPT
</li><li>Incident response experience &mdash; triage, containment, root-cause analysis
</li><li>Red teaming or purple teaming experience</li></ul></div>

Application Security Engineer

PackageX

<div>
 <strong>
  About PackageX
 </strong>
 :
 <br/>
 <br/>
 PackageX is the execution layer for physical AI in enterprise logistics. We enable enterprises to see, understand, and execute real-world logistics operations in real time using Vision-Language-Action intelligence.
 <br/>
 <br/>
 We sit between systems of record (ERP, WMS, TMS) and the physical world, turning cameras, people, and automation into deterministic, auditable workflows. Rather than replacing existing systems, PackageX makes them operationally intelligent.
 <br/>
 <br/>
 We start with inbound receiving, the highest-friction choke point in logistics, and expand across adjacent workflows, sites, and automation modes. This creates a workflow-led enterprise expansion motion that compounds inside complex operations.
 <br/>
 <br/>
 We're a fast-growing pre-Series A stage startup in New York City with a distributed global team backed by Bullpen Capital, Pritzker Group, Sierra Ventures, Ludlow Ventures, MXV Capital, and NSV Wolf Capital.
 <br/>
 <br/>
 <strong>
  What We Are Looking For
  <br/>
  <br/>
 </strong>
 We&rsquo;re looking for a security engineer who is serious about their craft and genuinely curious about where the field is heading. This role sits at the intersection of traditional application security and the new challenges that come with building AI-powered products. You&rsquo;ll own security end-to-end, from hardening our cloud infrastructure and reviewing code, to thinking through what it means to secure systems that use large language models. You don&rsquo;t need to have done this exact job before, but you should be the kind of engineer who stays curious, learns fast, and cares deeply about getting things right.
 <br/>
 <br/>
 <strong>
  You will:
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Own security across the SDLC from threat modeling during design, to security reviews during development, to vulnerability scanning in CI/CD. You&rsquo;ll use modern tooling (including AI-powered scanners where they genuinely help) to keep pace with a fast-moving engineering team
  </li>
  <li>
   Conduct vulnerability assessments and penetration tests across our web applications, APIs, and infrastructure. You&rsquo;ll identify issues before attackers do, document findings clearly, and work directly with developers to get them fixed
  </li>
  <li>
   Write and maintain security policies that engineers will actually follow, clear, practical, and grounded in how the team actually works, not copied from a compliance template
  </li>
  <li>
   Think carefully about the security risks that come with AI-powered products, such as prompt injection, sensitive data leaking through model outputs, and how to keep our LLM integrations safe for customers. This is a newer area, and you&rsquo;ll be helping us figure it out as we go
  </li>
  <li>
   Report on security posture to engineering leadership, tracking gaps, trends, and open issues in a way that helps the team prioritize and act, not just tick compliance boxes
  </li>
  <li>
   Review code for security issues and work closely with developers to fix them, building habits and processes so security feedback becomes a normal part of how the team ships, not a last-minute blocker
  </li>
  <li>
   Define and maintain security standards for how we build and deploy software, writing clear guidelines, putting automated checks in place, and making it easy for engineers to do the right thing by default
  </li>
  <li>
   Build automation that makes security work scale &mdash; whether that&rsquo;s smarter alerting, faster triage, or tooling that helps developers catch and fix issues without needing a security engineer in every conversation
  </li>
  <li>
   Participate in product and engineering design discussions &mdash; raising security concerns early, helping the team understand the risks, and finding solutions that don&rsquo;t slow down shipping
  </li>
  <li>
   Embed security into our CI/CD pipelines and development workflows &mdash; reducing the time between finding a vulnerability and getting it fixed, and making security a shared responsibility across the engineering team
  </li>
  <li>
   Keep up with how the security landscape is evolving &mdash; particularly as AI becomes a bigger part of how software is built and attacked. You&rsquo;ll bring that knowledge back to the team and help us stay ahead of new threats
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Skills and Qualification:
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   A degree in Computer Science, Information Security, or a related field
  </li>
  <li>
   3+ years of hands-on experience in application security or security engineering.
  </li>
  <li>
   Proven ability to build, manage, and monitor security in production environments where reliability matters &mdash; you&rsquo;ve operated under pressure, handled incidents, and know what it takes to keep systems safe at scale
  </li>
  <li>
   Solid experience securing web applications, APIs, and cloud infrastructure &mdash; covering areas like intrusion detection, access control design, incident response, and security policy development. You know the fundamentals well and can apply them in a real product context
  </li>
  <li>
   Experience with static and dynamic code analysis, you&rsquo;ve worked with SAST and DAST tools, know their limitations, and can help developers actually act on what those tools surface rather than just generating noise
  </li>
  <li>
   Familiarity with modern cloud architectures, serverless, microservices, and API-first designs. Bonus if you&rsquo;ve thought about what it means to secure systems that call LLM APIs or handle AI-generated outputs as part of their core workflow
  </li>
  <li>
   Strong understanding of OWASP Top 10 vulnerabilities and how to defend against them. Familiarity with the OWASP Top 10 for LLMs is a plus; we&rsquo;re building AI-powered products and need someone who can think through what that means for security
  </li>
  <li>
   Good understanding of RESTful API security, authentication, authorization, rate limiting, and input validation. Our platform is API-heavy, and we need someone who can spot the common mistakes and knows how to prevent them
  </li>
  <li>
   Strong experience in penetration testing and vulnerability analysis. You can run an assessment end-to-end, write up findings that people actually read, and follow through until issues are resolved &mdash; not just hand over a report and move on
  </li>
  <li>
   Experience working with AWS and/or GCP, securing cloud infrastructure, managing IAM policies, and understanding how cloud-native services introduce their own security considerations. We run primarily on AWS
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  What can you expect from the application process?
  <br/>
  <br/>
 </strong>
 All applications will be looked at by the People team, who will reach out to shortlisted candidates. Across various interview rounds, you'll speak with the hiring manager and other functional heads. We want to have an open discussion about your work and how we can be a great fit. The process may also involve an assessment or presentation relevant to the role. You can expect an offer after three rounds of interviews. All offers are subject to satisfactory reference and background checks.
 <br/>
 <br/>
 We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
</div>


Toyota North America

<div><p><b>Overview</b></p><p></p><p><b>
Who we are</b></p><p></p><div><p>
Collaborative. Respectful. A place to dream and do. These are just a few words that describe what life is like at Toyota. As one of the world&rsquo;s most admired brands, Toyota is growing and leading the future of mobility through innovative, high-quality solutions designed to enhance lives and delight those we serve. We&rsquo;re looking for talented team members who want to Dream. Do. Grow. with us.</p><p></p><p>
An important part of the Toyota family is Toyota Financial Services (TFS), the finance and insurance brand for Toyota and Lexus in North America. While TFS is a separate business entity, it is an essential part of this world-changing company- delivering on Toyota's vision to move people beyond what's possible. At TFS, you will help create best-in-class customer experience in an innovative, collaborative environment.</p></div><p></p><p><b>
To save time applying, Toyota does not offer sponsorship of job applicants for employment-based visas or any other work authorization for this position at this time.</b></p><p></p><p><b>
Who we&rsquo;re looking for</b></p><p>
Toyota Financial Services (TFS) Technology team is looking for a highly motivated person to fill a role as a Application Security Analyst. Your responsibilities will be to ensure the security of company software applications, web services, and APIs. You will work closely with development teams to identify vulnerabilities, suggest remediation efforts, and integrate security controls into the DevOps pipeline. The role involves ensuring the security and integrity of our products and third-party software, providing guidance on security risks.</p><p></p><p><b>
What you&rsquo;ll be doing</b></p><ul><li><p>
Collaborate with developers to &quot;shift left&quot;&mdash;integrating security early in the software development life cycle (SDLC)</p></li><li><p>
Integrate security tools like SAST, DAST, and SCA into development processes.</p></li><li><p>
Review code for security vulnerabilities and provide guidance to developers on remediation and secure coding practices.</p></li><li><p>
Prepare detailed vulnerability reports and dashboards for leadership, prioritizing risks based on business impact.</p></li><li><p>
Stay updated on emerging threats and vulnerabilities relevant to application security.</p></li><li><p>
Provide guidance and training on interpreting reports and strategies for remediation.</p></li></ul><p></p><p><b>
What you bring</b></p><ul><li><p>
Typically, 3-6 years of experience in application security, with significant hands-on experience using SAST/SCA/DAST tools and methodologies.</p></li><li><p>
Proven expertise in testing complex web applications, APIs, and mobile applications for security vulnerabilities.</p></li><li><p>
Strong understanding of application security standards (e.g., OWASP Top Ten, SANS CWE Top 25).</p></li><li><p>
Familiarity with programming languages and frameworks commonly used in web and mobile applications, including Java, Python, Bash/Shell Scripting, PHP, Javascript, etc.</p></li><li><p>
Strong understanding of CI/CD tools (e.g., Jenkins, Harness, GHA).</p></li><li><p>
Familiarity with containerization and orchestration (Docker, Kubernetes).</p></li><li><p>
Knowledge of cloud platforms (AWS, Azure, GCP) and their security features.</p></li><li><p>
Knowledge of Infrastructure as Code (Terraform, Ansible).</p></li></ul><p></p><p><b>
Added bonus if you have</b></p><ul><li><p>
Strong analytical and problem-solving skills.</p></li><li><p>
Excellent communication and collaboration abilities.</p></li><li><p>
Ability to work in a fast-paced, agile environment.</p></li><li><p>
Ability to lead security testing initiatives and mentor junior security engineers.</p></li></ul><p></p><p><b>
What we&rsquo;ll bring</b></p><p>
During your interview process, our team will provide detailed information about our industry-leading benefits and career development opportunities. Here are a few highlights:</p><ul><li><p>
A work environment built on teamwork, flexibility, and respect.</p></li><li><p>
Professional growth and development programs to help advance your career, including tuition reimbursement.</p></li><li><p>
Team Member Vehicle Purchase Discount.</p></li><li><p>
Toyota Team Member Lease Vehicle Program (if applicable).</p></li><li><p>
Comprehensive health care and wellness plans for your entire family.</p></li><li><p>
Toyota 401(k) Savings Plan with a company match, plus an annual retirement contribution from Toyota regardless of your own contributions.</p></li><li><p>
Paid holidays and paid time off.</p></li><li><p>
Referral services for prenatal services, adoption, childcare, schools, and more.</p></li><li><p>
Tax advantaged Accounts (Health Savings Account, Health Care FSA, Dependent Care FSA).</p></li><li><p>
Relocation assistance (if applicable).</p></li></ul><p></p><p><b>
Belonging at Toyota</b></p><p></p><p>
Our success begins and ends with our people. We embrace all perspectives and value unique human experiences. Respect for all is our North Star. Toyota is proud to have 10+ different Business Partnering Groups across 100 different North American chapter locations that support team members&rsquo; efforts to dream, do and grow without questioning that they belong.</p><p></p><p>
Applicants for our positions are considered without regard to race, ethnicity, national origin, sex, sexual orientation, gender identity or expression, age, disability, religion, military or veteran status, or any other characteristics protected by law.</p><p></p><p>
Have a question, need assistance with your application or do you require any special accommodations? Please send an email to talent.acquisition@toyota.com.</p></div>

Application Security Analyst

<div><div><div><div><b>About PackageX</b>:</div>
<div>
PackageX is the execution layer for physical AI in enterprise logistics. We enable enterprises to see, understand, and execute real-world logistics operations in real time using Vision&ndash;Language&ndash;Action intelligence.</div><br>
<div></div>
<div>
We sit between systems of record (ERP, WMS, TMS) and the physical world, turning cameras, people, and automation into deterministic, auditable workflows. Rather than replacing existing systems, PackageX makes them operationally intelligent.</div><br>
<div></div>
<div>
We start with inbound receiving, the highest-friction choke point in logistics, and expand across adjacent workflows, sites, and automation modes. This creates a workflow-led enterprise expansion motion that compounds inside complex operations.</div><br>
<div></div>
<div>
We're a fast-growing pre-Series A stage startup in New York City with a distributed global team backed by Bullpen Capital, Pritzker Group, Sierra Ventures, Ludlow Ventures, MXV Capital, and NSV Wolf Capital.</div><br>
<div></div>
<div><b>
What we are looking for</b></div>
<div>
We&rsquo;re looking for a security engineer who is serious about their craft and genuinely curious about where the field is heading. This role sits at the intersection of traditional application security and the new challenges that come with building AI-powered products. You&rsquo;ll own security end-to-end, from hardening our cloud infrastructure and reviewing code, to thinking through what it means to secure systems that use large language models. You don&rsquo;t need to have done this exact job before, but you should be the kind of engineer who stays curious, learns fast, and cares deeply about getting things right.</div><br>
<div></div>
<div><b>
You will:
</b></div><ul><li>Own security across the SDLC from threat modeling during design, to security reviews during development, to vulnerability scanning in CI/CD. You&rsquo;ll use modern tooling (including AI-powered scanners where they genuinely help) to keep pace with a fast-moving engineering team.</li>
<li>Conduct vulnerability assessments and penetration tests across our web applications, APIs, and infrastructure. You&rsquo;ll identify issues before attackers do, document findings clearly, and work directly with developers to get them fixed.</li>
<li>Write and maintain security policies that engineers will actually follow, clear, practical, and grounded in how the team actually works, not copied from a compliance template.</li>
<li>Think carefully about the security risks that come with AI-powered products, such as prompt injection, sensitive data leaking through model outputs, and how to keep our LLM integrations safe for customers. This is a newer area, and you&rsquo;ll be helping us figure it out as we go.</li>
<li>Report on security posture to engineering leadership, tracking gaps, trends, and open issues in a way that helps the team prioritize and act, not just tick compliance boxes.</li>
<li>Review code for security issues and work closely with developers to fix them, building habits and processes so security feedback becomes a normal part of how the team ships, not a last-minute blocker.</li>
<li>Define and maintain security standards for how we build and deploy software, writing clear guidelines, putting automated checks in place, and making it easy for engineers to do the right thing by default.</li>
<li>Build automation that makes security work scale &mdash; whether that&rsquo;s smarter alerting, faster triage, or tooling that helps developers catch and fix issues without needing a security engineer in every conversation.</li>
<li>Participate in product and engineering design discussions &mdash; raising security concerns early, helping the team understand the risks, and finding solutions that don&rsquo;t slow down shipping.</li>
<li>Embed security into our CI/CD pipelines and development workflows &mdash; reducing the time between finding a vulnerability and getting it fixed, and making security a shared responsibility across the engineering team.</li>
<li>Keep up with how the security landscape is evolving &mdash; particularly as AI becomes a bigger part of how software is built and attacked. You&rsquo;ll bring that knowledge back to the team and help us stay ahead of new threats.</li></ul><br>
<div></div>
<div><b>
Skills and Qualification:</b></div>
<ul>
<li>A degree in Computer Science, Information Security, or a related field</li>
<li>3+ years of hands-on experience in application security or security engineering.
</li><li>Proven ability to build, manage, and monitor security in production environments where reliability matters &mdash; you&rsquo;ve operated under pressure, handled incidents, and know what it takes to keep systems safe at scale.</li>
<li>Solid experience securing web applications, APIs, and cloud infrastructure &mdash; covering areas like intrusion detection, access control design, incident response, and security policy development. You know the fundamentals well and can apply them in a real product context.</li>
<li>Experience with static and dynamic code analysis, you&rsquo;ve worked with SAST and DAST tools, know their limitations, and can help developers actually act on what those tools surface rather than just generating noise.</li>
<li>Familiarity with modern cloud architectures, serverless, microservices, and API-first designs. Bonus if you&rsquo;ve thought about what it means to secure systems that call LLM APIs or handle AI-generated outputs as part of their core workflow.</li>
<li>Strong understanding of OWASP Top 10 vulnerabilities and how to defend against them. Familiarity with the OWASP Top 10 for LLMs is a plus; we&rsquo;re building AI-powered products and need someone who can think through what that means for security.</li>
<li>Good understanding of RESTful API security, authentication, authorization, rate limiting, and input validation. Our platform is API-heavy, and we need someone who can spot the common mistakes and knows how to prevent them.</li>
<li>Strong experience in penetration testing and vulnerability analysis. You can run an assessment end-to-end, write up findings that people actually read, and follow through until issues are resolved &mdash; not just hand over a report and move on.</li>
<li>Experience working with AWS and/or GCP, securing cloud infrastructure, managing IAM policies, and understanding how cloud-native services introduce their own security considerations. We run primarily on AWS.</li></ul><br>
<div></div>
<div><b>
What can you expect from the application process?</b></div>
<div>
All applications will be looked at by the People team, who will reach out to shortlisted candidates. Across various interview rounds, you'll speak with the hiring manager and other functional heads. We want to have an open discussion about your work and how we can be a great fit. The process may also involve an assessment or presentation relevant to the role. You can expect an offer after three rounds of interviews. All offers are subject to satisfactory reference and background checks.</div><br>
<p></p>
</div></div>
<div><div>We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.</div></div></div>

Schweitzer Engineering Laboratories

<div><div><div>Job Description</div></div><div><div><div><div><p>
The devices we make at SEL are embedded in the power grid. They prevent blackouts. They make outages safer and shorter in duration; they add cybersecurity, automation, and communication. They use cutting-edge technologies and operate at speeds that push other pieces of the grid to go faster. As an Application Engineer - Protection, you&rsquo;ll provide solutions and services that help our customers protect and control critical electrical infrastructure and power systems worldwide.</p><p></p><p><b>
As Application Engineer &ndash; Protection, a typical day might include the following:</b></p><ul><li><p>
Develop expertise in power system protection, and all related SEL products.</p></li><li><p>
Help customers apply SEL products through visits, demonstrations, training courses, email, and telephone contact.</p></li><li><p>
Contribute to product specifications, application and testing software, and literature.</p></li><li><p>
Participate in SEL marketing and sales activities and industry technical meetings and conferences.</p></li><li><p>
Teach in customer on-site and online visits, SEL University courses, and hands-on seminars for customers and SEL personnel.</p></li><li><p>
Maintain customer application and quality information, and develop industry relationships.</p></li><li><p>
Other duties as assigned.</p></li></ul><p></p><p><b>
This job might be for you if:</b></p><ul><li><p>
Your educational background is in electrical engineering</p></li><li><p>
You have a strong understanding of power system protection principles, relay protection and control schemes, and relay coordination techniques.</p></li><li><p>
You are familiar with relevant industry standards, such as IEEE, IEC, and NERC/FERC regulations.</p></li><li><p>
You have proven experience in designing and implementing protection and control schemes in a utility or industrial setting.</p></li><li><p>
Demonstrated problem-solving skills and the ability to analyze complex power system protection challenges.</p></li><li><p>
You are willing to travel locally &amp; internationally.</p></li><li><p>
You have strong communication skills in English &amp; Arabic.</p></li></ul><p></p><p><b>
Location
</b></p><p>Saudi Arabia - Khobar</p><p></p><p><b>
Why SEL?
</b></p><p><b>Competitive pay. Superior benefits. Inspiring work.
</b></p><p>We provide and take care of our employees with outstanding benefits, competitive pay, challenging work, and a rewarding career.</p><p>
Top tier medical, prescription, dental, vision, life, and disability insurance.</p><p>
Varied leave plans like annual leaves, sick leaves, parental leaves etc. to maintain a healthy life balance</p><p>
Yearly flight tickets to home country for expat employees and their family members based on their eligibility</p><p>
Developmental programs like tuition assistance, internships, skill development courses and engineering development programs (EDP).</p><p>
Wellbeing benefits like free and confidential Employee Assistance Program (EAP) and reimbursable yearly gym membership</p><p>
International Travel Medical and Security Assistance to assist our traveling employees and accompanying family members worldwide</p><p>
Additional compensation for working on customer sites in the field based on eligibility</p><p></p><p><b>
Pay Range Data</b></p><p>
We base our starting pay offer on location and job-related factors such as candidate experience, training, knowledge, and skills</p><p></p><p><b>
Communication with Applicants</b></p><p>
We communicate with all applicants. If you do not receive a response about your application, please check your SPAM filter or reach out to us at careers@selinc.com.</p><p></p><p>
SEL is an Equal Opportunity Employer: Vets/Disabled.</p></div></div></div></div></div><p></p>

Application Engineer II - Protection

Tata Consultancy Services (TCS)

<div></div><div><div><div><p>Experience &amp; Knowledge Vulnerability Management,Qualys guard , ServiceNow &middot; Executed and experienced in Manual Penetration Testing &middot; Performed Threat modelling &amp; Threat profiling &middot; Security testing related certifications &ndash; CEH, AppScan Certified etc &middot; Conducted secure code reviews &middot; Formulated Pen Testing plans &amp; strategies &middot; Good Security Report
</p></div></div><div><div><div><b>Location</b></div>
<div>Hyderabad</div>
</div><div><div><b>Job Function</b></div>
<div>TECHNOLOGY</div>
</div><div><div><b>Role</b></div>
<div>Analyst</div>
</div><div><div><b>Job Id</b></div>
<div>402868</div>
</div><div><div><b>Desired Skills</b></div>
<div>VAPT | VAPT Nexpose Rapid 7</div>
</div></div><p>Desired Candidate Profile
</p><div><div><b>Qualifications</b> : BACHELOR OF BUSINESS STUDIES, BACHELOR OF COMMERCE, BACHELOR OF COMPUTER APPLICATION</div></div></div><div></div>

Application security / Penetration Testing/VAPT(OSCP)

Jazz

<div>
 <p>
  <strong>
   Grade: L2
  </strong>
 </p>
 <p>
  <strong>
   Location: Islamabad
  </strong>
 </p>
 <p>
  <strong>
   Last date to apply: 26 April 2026
   <br/>
  </strong>
 </p>
 <p>
  <strong>
   What is Expert Application &amp; Product Security?
  </strong>
 </p>
 <p>
  <strong>
   Expert Application &amp; Product Security
  </strong>
  is responsible to drive secure design, development, and deployment of digital products. This role is responsible for embedding security across the&nbsp;
  <strong>
   software development lifecycle (SDLC)
  </strong>
  , securing APIs and microservices, and ensuring products are resilient against evolving cyber threats.
 </p>
 <p>
  Main responsibility of this role is to safeguard software applications for potential threats &amp; vulnerabilities by analyzing and effectively testing implementation of different application security controls to protect organization's digital footprint from cyber threats.
 </p>
 <p>
  The role reports directly to the Stream Head Cyber Security with an extended team of 11 team members.
 </p>
 <p>
  &nbsp;
 </p>
 <p>
  <strong>
   What does Expert Application &amp; Product Security?
  </strong>
 </p>
 <p>
  1.&nbsp;&nbsp;&nbsp;&nbsp; Define and lead the&nbsp;
  <strong>
   Application Security (AppSec) strategy
  </strong>
  &nbsp;across all products
 </p>
 <p>
  2.&nbsp;&nbsp;&nbsp;&nbsp; Establish secure SDLC (SSDLC) frameworks and governance
 </p>
 <p>
  3.&nbsp;&nbsp;&nbsp;&nbsp; Develop policies, standards, and secure coding guidelines
 </p>
 <p>
  4.&nbsp;&nbsp;&nbsp;&nbsp; Align AppSec with enterprise risk management and business objectives
 </p>
 <p>
  5.&nbsp;&nbsp;&nbsp;&nbsp; Conduct threat modelling (STRIDE, attack trees) for applications and platforms
 </p>
 <p>
  6.&nbsp;&nbsp;&nbsp;&nbsp; Review and approve secure architectures for:
 </p>
 <p>
  a.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Web and mobile applications
 </p>
 <p>
  b.&nbsp;&nbsp;&nbsp;&nbsp; APIs and microservices
 </p>
 <p>
  c.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Cloud-native platforms
 </p>
 <p>
  7.&nbsp;&nbsp;&nbsp;&nbsp; Enforce best practices based on&nbsp;OWASP&nbsp;standards (Top 10, ASVS, API Top 10)
 </p>
 <p>
  8.&nbsp;&nbsp;&nbsp;&nbsp; Integrate security into CI/CD pipelines:
 </p>
 <p>
  a.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SAST, DAST, SCA, IAST
 </p>
 <p>
  9.&nbsp;&nbsp;&nbsp;&nbsp; Automate security testing and policy enforcement
 </p>
 <p>
  10.&nbsp; Work closely with DevOps teams to implement "shift-left" security
 </p>
 <p>
  11.&nbsp; Define security gates and release criteria
 </p>
 <p>
  12.&nbsp; Secure externally exposed products and services
 </p>
 <p>
  13.&nbsp; Implement API security controls:
 </p>
 <p>
  a.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Authentication (OAuth2, JWT)
 </p>
 <p>
  b.&nbsp;&nbsp;&nbsp;&nbsp; Rate limiting, bot protection
 </p>
 <p>
  14.&nbsp; Protect against:
 </p>
 <p>
  a.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Injection attacks
 </p>
 <p>
  b.&nbsp;&nbsp;&nbsp;&nbsp; Broken authentication
 </p>
 <p>
  c.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Business logic abuse
 </p>
 <p>
  15.&nbsp; Secure Android/iOS applications:
 </p>
 <p>
  a.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Reverse engineering protection
 </p>
 <p>
  b.&nbsp;&nbsp;&nbsp;&nbsp; Runtime protection (RASP)
 </p>
 <p>
  c.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Secure storage &amp; communication
 </p>
 <p>
  16.&nbsp; Conduct mobile app security testing
 </p>
 <p>
  17.&nbsp; Implement API gateways and secure API lifecycle management
 </p>
 <p>
  18.&nbsp; Conduct secure coding training for developers
 </p>
 <p>
  19.&nbsp; Provide remediation guidance and best practices
 </p>
 <p>
  20.&nbsp; Build a security-first culture within software engineering teams
 </p>
 <p>
  &nbsp;
 </p>
 <p>
  <em>
   JazzWorld is an equal opportunity employer. We celebrate, support, and thrive on diversity and are committed to creating an inclusive environment for all employees.
   <br/>
   <br/>
  </em>
 </p>
 <strong>
  Requirements
  <br/>
  <br/>
 </strong>
 <p>
  <strong>
   What are we looking for and what does it require to be Expert Application &amp; Product Security?
  </strong>
 </p>
 <ul>
  <li>
   BS/MS in CyberSecurity/Information security/Information Technology
  </li>
  <li>
   Practical experience of application security in Banking / Telco sector
  </li>
 </ul>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; At least 04 years of experience in security design and penetration testing of mobile applications &amp; APIs
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  <strong>
   Functional
  </strong>
 </p>
 <p>
  o&nbsp;&nbsp; Ability to organize, plan and document tasks;
 </p>
 <p>
  o&nbsp;&nbsp; Ability to manage internal &amp; external stakeholders;
 </p>
 <p>
  o&nbsp;&nbsp; Possess good logical and analytical skills to help in analysis of Cyber Security risks
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  <strong>
   Technical
  </strong>
 </p>
 <p>
  o&nbsp;&nbsp; Strong expertise in:
 </p>
 <p>
  &sect;&nbsp; Web application security (OWASP Top 10)
 </p>
 <p>
  &sect;&nbsp; API security and microservices
 </p>
 <p>
  &sect;&nbsp; Authentication &amp; authorization models
 </p>
 <p>
  o&nbsp;&nbsp; Experience with manual penetration testing
 </p>
 <p>
  o&nbsp;&nbsp; Hands-on with:
 </p>
 <p>
  &sect;&nbsp; SAST: Checkmarx, Fortify, SonarQube
 </p>
 <p>
  &sect;&nbsp; DAST: Burp Suite, OWASP ZAP
 </p>
 <p>
  &sect;&nbsp; SCA: Snyk, Black Duck
 </p>
 <p>
  o&nbsp;&nbsp; Understanding of:
 </p>
 <p>
  &sect;&nbsp; Java, .NET, Node.js, Python (at least one deeply)
 </p>
 <p>
  &sect;&nbsp; CI/CD pipelines (Jenkins, GitLab, GitHub Actions)
 </p>
 <p>
  o&nbsp;&nbsp; Familiarity with Infrastructure as Code (Terraform, etc.)
 </p>
 <p>
  o&nbsp;&nbsp; Lead and mentor Application Security Testers
 </p>
 <p>
  o&nbsp;&nbsp; Define KPIs and performance metrics
 </p>
 <p>
  o&nbsp;&nbsp; Stakeholder management across Dev, QA, Product, and Risk teams
  <br/>
  <br/>
 </p>
 <strong>
  Benefits
  <br/>
  <br/>
 </strong>
 <p>
  <strong>
   Why join JazzWorld?
  </strong>
 </p>
 <p>
  As a certified Top Employer, JazzWorld reflects workplace standards benchmarked against leading global organizations, demonstrating our commitment to creating an environment where people can thrive and perform at their best. Our teams are driven by the belief that every JazzWorld employee should be inspired to live better every day, enabled by forward-looking leadership, an open culture, meaningful work, and continuous opportunities to learn and grow.
 </p>
 <p>
  Our core values - Customer Obsession, Truthful, Innovation, Collaboration, and Entrepreneurial shape how we think, decide, and lead. They encourage us to challenge convention, act with accountability, work as one team, and create solutions that truly matter for our customers and communities.
 </p>
 <p>
  As Pakistan's largest digital operator, JazzWorld serves over 100 million through connectivity, digital services, financial inclusion, entertainment, and insurance. Joining us means being part of transformation at a national scale; expanding access, unlocking opportunity, and building a more connected digital future.
 </p>
 <p>
  At JazzWorld, everything we do is rooted in one shared ambition. This purpose defines how we work, the progress we enable, and the difference we strive to make every day a Better Life For All.
 </p>
</div>


Expert Application & Product Security

Search 10000+ Application security developer jobs near you this May. New roles added regularly across leading industries. Apply today.

10000 application security developer jobs Near Me

Application Security Engineer

Application Security Engineer

Application Security Analyst

Application Security Engineer

Application Engineer II - Protection

Application security / Penetration Testing/VAPT(OSCP)

Expert Application & Product Security