Technology & Intelligence Ref XE-TEC-198 Closed

Application Security Engineer

Own application security on every client build: threat models before code, scanning in the pipeline and red-team tests of the AI features we release.

This role closed to applications on 8 Oct 2026.

This page stays up so links to it keep working. See the open roles, or send a speculative application; the practice reads those too.

Open roles in Technology & Intelligence Send a speculative application
Share Email it
Two engineers at a desk discussing code on a monitor, one leaning over the other's shoulder.
The practiceTechnology & Intelligence
Practice
Technology & Intelligence
Location
Remote (India)
Work pattern
Remote
Level
Senior
Type
Full-time
Experience
5+ years
Salary band
₹26–40 lakh a year Indicative
Openings
1
Posted
Closed

About the role

You will make what we build secure by design rather than by audit, with findings written so developers act on them.

A growing share of the work is AI: red-teaming features for prompt injection and data exfiltration. You will also help clients map their controls to the frameworks they report against: ISO/IEC 27001, the DPDP Act and newer AI-specific ones.

What you will do

  1. Threat-model new products and features with the teams building them
  2. Own SAST, dependency and secrets scanning in CI
  3. Red-team AI features for prompt injection and data exfiltration
  4. Help clients map controls to the frameworks they report against
  5. Write findings that are specific, ranked and fixable

A typical week

How the hours split in a typical week. Agents draft and check some tasks; you decide what happens next.

Application Security Engineer 40 hours in a typical week
  • You24 h · 60%
  • You, with an agent drafting8 h · 20%
  • An agent runs it, you review8 h · 20%

  1. Threat modelling with build teams

    Before any code: what could go wrong and what to build in.

    You8 h

  2. Pipeline scanning and triage

    Scanners run on every change; you triage what they raise and cut false alarms.

    An agent runs it, you review8 h

  3. Red-teaming AI features

    An agent generates attack variants; you design the attacks that matter and judge the results.

    You, with an agent drafting8 h

  4. Writing findings and fixes

    Specific, ranked and fixable, written for the developer who has to act on them.

    You8 h

  5. Mapping client controls

    ISO/IEC 27001, the DPDP Act and the newer AI frameworks clients report against.

    You8 h

An illustrative split. In your first conversation, the hiring lead talks you through how the week runs.

What you bring

  • 5+ years in application security or security engineering
  • Hands-on with OWASP ASVS and secure code review
  • Clear written findings that developers act on
  • Familiarity with the DPDP Act and GDPR

Nice to have

  • Cloud security posture tooling
  • ISO 27001 or SOC 2 audits from the delivery side

None of this is required. If you have most of the list above, apply.

Tools you will use

Grouped by purpose. Nobody knows all of them on day one.

Containers, IaC & CI/CD
  • GitHub Actions
  • Kubernetes
Testing & quality
  • SonarQube
Security & identity
  • OWASP
  • Burp Suite
  • Snyk
  • Trivy
  • Vault

Tools we work with and license. No partnership is implied.

Your first 90 days

  1. Days 1–30

    Review the pipeline scanning on two live projects and close the gaps you find

  2. Days 31–60

    Run a threat-modelling session for a new client build

  3. Days 61–90

    Red-team one AI feature and turn the findings into test cases the team keeps

A hand-drawn goal review on dot-grid paper: tallies for weeks one to eleven beside an assess-and-plan column, two pens resting on the page.
The plan is written down before your first day, and you review it with your lead as the weeks go by.

Where you would work

Where this role can be based. Each team agrees its own office days; remote roles join a team week in an office each quarter.

  • Two people talking over a laptop at a café table on a balcony in Dharamkot, Himachal Pradesh, forested hills behind them.

    Remote

    Anywhere in India

    For roles marked remote: anywhere in India, with a team week in an office each quarter.

    Pictured: Dharamkot, Himachal Pradesh

How and where we work

What we offer

With every role

  • Health and family

    Medical insurance · Parental leave · Mental health

  • Time

    Paid leave · Winter break · Flexible days

  • Growth

    Learning budget · Growth reviews · Internal moves

  • Setup

    Your own machine · Home office · Team weeks

The full benefits schedule

The team

Technology & Intelligence, the practice behind this role.

Engineers who build websites, platforms, data systems and AI products, with tests, evaluations and security checks on every change.

Open roles in this practice
3 on the board
Based in
Remote (India) · New Delhi · Ludhiana
Code on a screen in close-up: SVG gradient and filter definitions in pink, blue and white on a dark editor.
The practice at work Technology & Intelligence

What Technology & Intelligence delivers for clients

About Technology & Intelligence

Where this role sits

L4 of 6 · Senior

Owns a workstream. Sets the approach and develops others.

Each level is defined by the scope you own, not years served. Growth reviews twice a year measure you against the six standards at your level.

See career paths
  1. L1 Intern A task
  2. L2 Associate A deliverable
  3. L3 Mid A feature
  4. This role L4 Senior A workstream
  5. L5 Lead An engagement
  6. L6 Principal A practice

Level below

L3 · Mid — A feature. Owns a piece of work from start to finish.

Next level

L5 · Lead — An engagement. Leads a team and the client relationship.

How we hire

5 steps, and a reply after every one.

The five stages we use for every role. Timings are targets; if one slips, we tell you.

  1. Within 5 working days

    Step 1: Read

    Someone from the practice reads your application, links first and CV second, with no keyword filter or recruitment agency.

  2. Week 1 · 45 min

    Step 2: Conversation

    The hiring lead talks through the role and your work, and states the level and salary band before you invest more time.

  3. Week 2 · 2–3 h, paid

    Step 3: Work sample

    A short exercise close to the job, or a deep review of work you have already done, paid either way.

    Work sample · the brief

  4. Week 3 · half a day

    Step 4: Team day

    Meet the people you would work with, in an office or on video, and ask them anything.

  5. Week 3–4

    Step 5: Offer

    A written offer with the level, salary, full benefits and a start date that suits you, and time to decide.

What helps an application

  • A link to work you made, with your own part in it named.
  • One project you could talk through for half an hour.
  • If you used AI, a line on how you checked what it produced.
  • Plain words are fine. We read for substance.

Adjustments. Need extra time, questions in advance, captions or another format? Tell us on the form or by email. Asking never counts against you.

Next step

If no role fits, tell us what you would build.

Someone in the practice you choose reads your application like any other and replies either way.

Send a speculative application