BENGALURU · FULLTIME
Application Security Engineer-2
Upstox
Bengaluru · onsite · Posted 22d ago
Sourced from
Undisclosed3–5 yrsfulltimeBengaluru
About a minute. You'll make an account on the way through.
agent · working
- Read this posting0.7s
- Found the form on Naukri · 13 questions to answer1.3s
- Decided the answers for all of them3.0s
- Tailor your résumé to this role
- Waiting for you
Section · 01
About this role
About the Role
What You'll Do
What We're Looking For
Good to Have
Why Join Us
Upstox is looking for a Security Engineer 2 to join our Application Security team. This is a senior individual-contributor role for someone who has moved beyond executing assessments to owning the security posture of our cloud infrastructure, CI/CD pipelines, and containerized services, and who can write real production-quality code to build the internal tools that scale our security program.
You'll work closely with Engineering, Platform, and DevOps teams to embed security into how we build and ship software, while also mentoring Security Engineer 1s and raising the technical bar across the team.
What You'll Do
- Own end-to-end security architecture reviews for new and changing systems, assessing the application layer, AWS infrastructure, and container/orchestration layer together as one system, rather than reviewing each in isolation, and driving remediation of what you find at scale rather than flagging issues one at a time.
- Embed security checks directly into CI/CD pipelines (SAST, SCA/dependency scanning, container image scanning, secrets detection, IaC scanning) so vulnerabilities are caught before merge, not after deployment.
- Own container and orchestration security hardening, Docker images, reviewing Kubernetes configurations (RBAC, network policies, pod security standards), and closing gaps in how workloads are built and run in production.
- Design, build, and maintain in-house security tools and automation. Think internal scanners, policy-as-code checks, dashboards that aggregate findings across systems, just-in-time access tools, or automation that removes manual steps from recurring assessments. This is a coding role as much as a security one.
- Perform penetration testing across web applications, mobile applications (Android/iOS), and APIs to identify vulnerabilities before they reach production.
- Conduct manual and tool-assisted source code reviews to catch security issues early in the development cycle.
- Partner with engineering teams to embed security into the Secure SDLC, including security requirements, design reviews, and release gating.
- Drive and participate in threat modeling exercises for new features and systems.
- Configure, tune, and manage WAF rules (Cloudflare/AWS WAF) to protect production applications and APIs.
- Stay current with the evolving threat landscape, new attack techniques, and security tooling.
- Partner with the Platform/DevOps team on Infrastructure-as-Code (Terraform, CloudFormation) security reviews before infrastructure changes ship.
- Track and drive remediation of vulnerabilities across applications against SLA, working directly with Engineering and Platform teams to close gaps.
What We're Looking For
- 3-5 years of hands-on experience in Application, Product, or Cloud Security.
- Strong, hands-on AWS security knowledge, including:
- IAM design and least-privilege policies
- VPC/network security
- Secrets management (e.g., Secrets Manager, KMS)
- Logging and detection (CloudTrail, GuardDuty)
- Common cloud misconfiguration patterns
This needs to be real operational depth, not just familiarity with the console. - Solid understanding of CI/CD pipelines and how to secure them:
- Pipeline-as-Code
- Build system trust boundaries
- Artifact integrity
- Secrets in pipelines
- Automated security gates (SAST, SCA, container scanning, IaC scanning)
Ability to implement these without breaking developer velocity. - Practical container security experience:
- Docker image hardening
- Kubernetes security fundamentals
- RBAC
- Network policies
- Secrets handling
- Pod Security Standards
- Strong coding fundamentals in at least one of:
- Python
- Go
- Rust
Ability to design and ship a real tool, not just write one-off scripts. This role builds security tooling that other engineers will depend on. - Solid foundation in application security fundamentals:
- Penetration testing across web, mobile, and API environments
- Manual source code review
- Secure SDLC
- Threat modeling
- Authentication and authorization protocols (SAML, OAuth, OIDC)
- Experience with Infrastructure-as-Code security review (Terraform, CloudFormation, or similar).
- Understanding of software supply chain security, including:
- Dependency risk
- SBOMs
- Build and artifact integrity
- Working understanding of AI/LLM security risks:
- Prompt injection
- Insecure output handling
- Model/data poisoning
- Excessive agency in AI-integrated systems
- Strong communication skills. This role influences Engineering and Platform teams directly and will mentor more junior engineers.
Good to Have
- Experience with Policy-as-Code tools (OPA/Rego, Kyverno, or similar) for automated compliance and security checks.
- Exposure to a service mesh (Istio, Linkerd) and its security implications.
- Relevant certifications such as:
- OSCP
- OSWE
- OSCE
- AWS Security Specialty
- CKS
Bug bounty experience is a plus but not mandatory. - Experience operating or building internal security platforms and dashboards at a previous company.
Why Join Us
- Own security architecture decisions for high-scale, high-stakes financial products used by millions of users, not just review them after the fact.
- Build real internal tools used daily by the Security and Engineering teams, with the autonomy to decide how they are designed.
- Work across the full stack of modern cloud-native security, including AWS, CI/CD, containers, and application code, rather than being siloed into one narrow area.
- Join a collaborative team that invests in your growth, including a path toward technical leadership and mentoring the next generation of Application Security engineers.
By applying for this position, you acknowledge that you have reviewed our Prospective Employee Privacy Notice, which outlines how Upstox collects, uses, and protects your Personal Information (PI). I accept Upstox's Prospective Employee Privacy Notice.
Upstox is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, veteran status, or other protected characteristics.
Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.
Sourced from naukri
Section · 02
Skills
AutomationDevopsCI/CD Pipelinesapisamazon web servicesaws cloudformationcontainer securityCloudflareContainerAndroiddeploymentcloudAws SecurityCloud SecurityApplication SecurityCommunication SkillsArchitecturecomplianceArtificial Intelligence
Section · Company
About Upstox

Upstox
FinTech
550
employees
2009
17 years old
Mumbai,Maharashtra
India
About
We're one of India’s fastest-growing fintech platforms, backed by the best, including Mr. Ratan Tata and Tiger Global, and on a mission to make wealth creation accessible to every Indian.
Industries
Internet
Employee ratings
208 reviews
3.4/ 5
Culture
3.3
Career growth
2.9
Work-life
3.3
Employees rate it well for
Senior Management23Work Life Balance20Salary18Work Culture15Career Growth11
Find them on