Security Engineer III

Job Description

The security team at Meesho is responsible for building resilient systems to manage millions of orders every day.

As a Security Engineer 3, you are a senior individual contributor who owns security outcomes end to end across one or more product areas.

Key Responsibilities

• Security Architecture & Threat Modeling: Lead threat modeling and secure design reviews for complex, multi-service features, and partner with engineering to drive the resulting security requirements into production.
• Application & Offensive Security: Own and conduct advanced security assessments across web platforms, APIs, and mobile applications.
• Manual Code Review: Perform in-depth manual and automated source code reviews to identify security-critical bugs.
• DevSecOps & Automation: Own the integration, tuning, and scaling of security tooling in CI/CD.
• Cloud Security: Drive security reviews and hardening of cloud-native workloads.
• AI/LLM Security: Contribute to securing Meesho's AI-powered features and workflows.
• Vulnerability & Bug Bounty Management: Own vulnerability lifecycle and remediation tracking for your areas.
• Security Metrics: Define and track security metrics for your areas.
• Security Partnership & Mentorship: Act as a security subject matter expert for developers.
• Security Culture & Compliance: Drive security culture initiatives and contribute to risk and compliance efforts.

Requirements

• 5-7 years of hands-on experience in product security or application security.
• Proven ability to lead threat modeling sessions and drive findings into the SDLC.
• Strong proficiency performing security assessments on web applications and APIs.
• Hands-on manual source code review experience.
• Demonstrated experience with DevSecOps, integrating and tuning security tooling in CI/CD pipelines.
• Proficiency with cloud security on AWS or GCP.
• Offensive Security: Demonstrated experience planning and executing red team or purple team exercises.
• Mobile Security: Working knowledge of mobile application security assessments for Android and iOS.
• General Skills & Acumen: Strong analytical and problem-solving skills, excellent communication skills.

Nice to Have

• Relevant certifications such as OSCP, OSWE, GWAPT, or CKS.
• Active participation in public or private bug bounty programs.
• Experience speaking at meetups or conferences.
• Exposure to AI/LLM security and software supply-chain security.