Security Engineer IV

About the Team

The security team at Meesho plays a crucial role in protecting the company's products and systems. With a strong focus on teamwork and constructive feedback, the team works to build resilient systems that can handle millions of orders daily.

About the Role

As a Security Engineer IV, you will be responsible for ensuring the security of Meesho's products throughout their development lifecycle. Your tasks will include:

• Participating in threat modeling and design reviews to identify potential risks early
• Integrating and managing SAST tools within the CI/CD pipeline for continuous security testing
• Leading and conducting vulnerability assessments and penetration testing to proactively address security vulnerabilities
• Managing and optimizing a self-managed bug bounty program
• Providing security architectural guidance to Engineering and IT teams
• Leading security training and awareness campaigns across the organization

Responsibilities

• Lead and manage all aspects of the Secure Software Development Lifecycle (SDLC)
• Implement and manage security tools within the CI/CD pipeline (DevSecOps)
• Conduct and oversee VAPT for web applications, APIs, iOS, and Android apps
• Perform threat modeling, design, and architecture reviews to identify potential risks
• Execute manual source code reviews and enhance security in production environments
• Manage issues identified from penetration tests and bug bounty programs
• Manage Web Application Firewalls (WAF) to ensure robust protection
• Engage in the Security Champions program to integrate security practices within teams
• Assist in creating and maintaining Security Risk Models for both new and existing systems

Requirements

• 7+ years of experience in product security, with a focus on application security and Dev SecOps
• Proven experience in leading architectural changes or cross-team efforts to mitigate security vulnerabilities
• Proficiency in programming languages such as Java, React, Node.js, and Python
• Hands-on experience with manual source code reviews and securing production code
• Expertise in deploying and managing security tools in CI/CD pipelines
• Experience with Git, Jenkins, Artifactory, or other similar technologies
• Strong background in securing the software development lifecycle, including eliminating classes of vulnerabilities
• Proficiency with cloud platforms like AWS or GCP, including their security tools
• Experience with Docker and containerization technologies is highly desirable

Nice to Have

• Relevant certifications such as GIAC Web Application Penetration Tester (GWAPT), OffSec’s Advanced Web Attacks and Exploitation (WEB-300), etc.
• Strong understanding of SSO protocols, including OAuth and SAML
• Experience speaking at meetups or conferences
• Experience participating in bug bounty programs