# Security Engineer IV

**Company**: Meesho
**Location**: Bangalore, Karnataka
**Work arrangement**: onsite
**Experience**: senior
**Job type**: Full Time Employee
**Category**: IT
**Industry**: Technology

**Apply**: https://jobs.lever.co/meesho/f4e2e8e1-6863-4fe0-85fb-7840189cad3f?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_e1a00b96-4ca

## Description

### About the Team

The security team at Meesho plays a crucial role in protecting the company's products and systems. With a strong focus on teamwork and constructive feedback, the team works to build resilient systems that can handle millions of orders daily.

### About the Role

As a Security Engineer IV, you will be responsible for ensuring the security of Meesho's products throughout their development lifecycle. Your tasks will include:

- Participating in threat modeling and design reviews to identify potential risks early

- Integrating and managing SAST tools within the CI/CD pipeline for continuous security testing

- Leading and conducting vulnerability assessments and penetration testing to proactively address security vulnerabilities

- Managing and optimizing a self-managed bug bounty program

- Providing security architectural guidance to Engineering and IT teams

- Leading security training and awareness campaigns across the organization

### Responsibilities

- Lead and manage all aspects of the Secure Software Development Lifecycle (SDLC)

- Implement and manage security tools within the CI/CD pipeline (DevSecOps)

- Conduct and oversee VAPT for web applications, APIs, iOS, and Android apps

- Perform threat modeling, design, and architecture reviews to identify potential risks

- Execute manual source code reviews and enhance security in production environments

- Manage issues identified from penetration tests and bug bounty programs

- Manage Web Application Firewalls (WAF) to ensure robust protection

- Engage in the Security Champions program to integrate security practices within teams

- Assist in creating and maintaining Security Risk Models for both new and existing systems

### Requirements

- 7+ years of experience in product security, with a focus on application security and Dev SecOps

- Proven experience in leading architectural changes or cross-team efforts to mitigate security vulnerabilities

- Proficiency in programming languages such as Java, React, Node.js, and Python

- Hands-on experience with manual source code reviews and securing production code

- Expertise in deploying and managing security tools in CI/CD pipelines

- Experience with Git, Jenkins, Artifactory, or other similar technologies

- Strong background in securing the software development lifecycle, including eliminating classes of vulnerabilities

- Proficiency with cloud platforms like AWS or GCP, including their security tools

- Experience with Docker and containerization technologies is highly desirable

### Nice to Have

- Relevant certifications such as GIAC Web Application Penetration Tester (GWAPT), OffSec’s Advanced Web Attacks and Exploitation (WEB-300), etc.

- Strong understanding of SSO protocols, including OAuth and SAML

- Experience speaking at meetups or conferences

- Experience participating in bug bounty programs

## Skills

### Required
- application security
- DevSecOps
- threat modeling
- vulnerability assessments
- penetration testing
- security tools
- CI/CD pipeline
- cloud platforms
- containerization

### Nice to have
- GIAC Web Application Penetration Tester (GWAPT)
- OffSec’s Advanced Web Attacks and Exploitation (WEB-300)
- SSO protocols
- OAuth
- SAML
- bug bounty programs

---

Source: [Apply at jobs.lever.co](https://jobs.lever.co/meesho/f4e2e8e1-6863-4fe0-85fb-7840189cad3f?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)