# Senior Application Security Engineer

**Company**: Hewlett Packard Enterprise
**Location**: Bengaluru, Karnātaka
**Work arrangement**: remote
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Technology

**Apply**: https://hpe.wd5.myworkdayjobs.com/en-US/Jobsathpe/job/Bengaluru-Karntaka-India/Senior-Application-Security-Engineer_1217896?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_1897916e-003

## Description

We are hiring a Senior Application Security Engineer to build how our enterprise secures software, from first commit to production. You will design the guardrails, automation, and AI-powered tooling that let engineering teams ship securely by default, and you will prove they work with data.

**Responsibilities:**

### Secure SDLC & DevSecOps

- Build security into the SDLC as paved roads, so the secure path is the easiest path for every engineering team.

- Define the secure coding standards and reference patterns that teams across the enterprise build against.

- Build the vulnerability prioritization capability that shows where real risk sits across code, pipelines, and deployed services, and drive remediation to measurable closure.

- Establish a threat modeling practice for applications, APIs, and delivery pipelines that scale beyond a single team.

### CI/CD & software supply chain security

- Architect the security control layer for our CI/CD platforms (GitHub Actions, Jenkins, GitLab, Azure DevOps) so every pipeline inherits it by default.

- Design the automated testing pipeline that runs SAST, DAST, SCA, and container scanning on every build, tuned for signal over noise.

- Build the automation that keeps our attack surface visible: API discovery, dependency scanning, SBOM generation, and secrets detection.

### AI/LLM security & AI-powered automation

- Build reusable AI agent skills and workflows inside CI/CD (e.g., agentic coding tools, MCP-based integrations) that review every pull request for insecure patterns, authN/authZ gaps, secrets exposure, and risky dependency changes, and deliver CWE/OWASP-mapped findings developers can act on.

- Build AI-driven security testing that generates targeted test cases (API abuse cases, fuzzing inputs, prompt-injection and jailbreak suites), triages SAST/SCA/DAST results to cut false positives and proposes remediation PRs for human review.

- Define the guardrails AI agents operate under our pipelines: least-privilege tokens, human-in-the-loop approval, output-accuracy evaluation, and audit logging.

- Build the AI-specific scanning capability that catches insecure LLM orchestration patterns before they ship.

- Establish a reusable threat modeling approach for RAG architectures and autonomous agents.

- Define the framework for secure AI adoption in enterprise applications, covering data security, access controls, model input/output handling, and misuse prevention.

### Partnership & enablement

- Demonstrated ability to drive initiatives end-to-end, taking ownership of tasks, deliverables, and outcomes.

- Shape product, platform, and DevOps roadmaps as trusted advisors, translating technical risk into business decisions.

- Choose, implement, and prove the tooling that closes the gaps we have today, with metrics that show the impact.

- Grow security capability inside engineering teams through mentoring secure coding and pipeline practices.

- Help scale the Security Champions program into a self-sustaining network.

**Requirements:**

- 6+ years in Application Security, Product Security, or Secure Software Development, with a track record of building capabilities, not only operating them.

- Has designed security controls for CI/CD pipelines and source repositories (GitHub, GitLab, Jenkins, or similar) at scale.

- Has built and tuned SAST, DAST, SCA, and container scanning, so developers trust and act on the results.

- Has built and tuned WAF and API protections and driven vulnerability remediation to closure.

- Applies SLSA and NIST SSDF to design build integrity, including secrets management and artifact signing.

- Has designed security controls in AWS, Azure, or GCP.

- Deep understanding of OWASP Top 10 (Web & API), CWE, and secure coding practices.

- Working knowledge of OWASP Top 10 for LLM Applications and MITRE ATLAS.

**Benefits:**

- Comprehensive suite of benefits that supports physical, financial, and emotional wellbeing.

- Investment in career development and growth.

- Unconditional inclusion and celebration of individual uniqueness.

## Skills

### Required
- Application Security
- Product Security
- Secure Software Development
- CI/CD pipelines
- SAST
- DAST
- SCA
- container scanning
- WAF
- API protections
- SLSA
- NIST SSDF
- AWS
- Azure
- GCP
- OWASP Top 10
- CWE
- secure coding practices

### Nice to have
- LLM-powered developer or security tooling
- prompt/skill design
- tool and MCP integration
- evaluation of output quality and false-positive rates
- Sigstore/Cosign or similar tooling
- SBOM generation and SCA into CI/CD workflows
- runtime protection (API security platforms, RASP, container EDR)
- GitOps
- IaC scanning (Terraform, CloudFormation)
- policy-as-code guardrails

---

Source: [Apply at hpe.wd5.myworkdayjobs.com](https://hpe.wd5.myworkdayjobs.com/en-US/Jobsathpe/job/Bengaluru-Karntaka-India/Senior-Application-Security-Engineer_1217896?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)