Principal Application Security Engineer

2 weeks ago

Bengaluru, India Livestream Full time
Principal Application Security Engineer

As a Principal Application Security Engineer at Vimeo, you will engage in a variety of activities, either offensive, defensive, or some combination thereof, ultimately aimed at safeguarding our users who entrust Vimeo with their content every day.You’ll plan, carry out, and lead security initiatives to monitor and protect sensitive data and systems from infiltration and cyber-attacks.You will likely collaborate frequently with and support developers, as well as members of the infrastructure security team, the compliance team, IT, Product, and other teams throughout the organization.You love to solve puzzles, and are a great team player.This role is remote.You must be comfortable working evenings. The role requires 40 hours of work per week on average, Monday through Friday. The role requires three hours of overlap with the US Eastern time zone (i.e., New York City) daily. Please note that the hours vary slightly throughout the year due to Daylight Savings Time.The expected hours are:Summer months (second Sunday in March thru first Sunday in November): 1:30 PM - 9:30 PM ISTWinter months (first Sunday in November through the second Sunday in March): 2:30 PM - 10:30 PM ISTWhat you’ll do:Depending on your preferences and the current needs of the team, you may either focus on just one or two of the following areas, or you may choose to become involved with many of them.Security architecture

— create a technical plan for partitioning and consolidating our cookies; draft up a sequence diagram for a new middleware to prevent IDOR attacks; implement a POC for leveraging CAPTCHA challenges in cross-origin embedded iframes; draft some code to modify the expiration behavior of our JWTs then pair with our API team to get feedbackPenetration testing

— either hunt for security issues on our production or staged applications during an open-box internal pen test, or help coordinate an engagement with an external firmWriting code for internal automated security tools

— write some code, usually in Python, Bash, or Go, to support any of our team's various initiatives. Often we strive to facilitate a culture of “paved roads” for our developers, such that it is easy for any developer to incorporate security into their designs and implementationsThreat modeling

— consider how malicious attackers may compromise our systems, and advise developers and product managers on what defenses are neededCode reviews

— discover weakness in our source code before it reaches productionBug bounty program

— help triage new incoming reports on a daily basis, plus launch creative initiatives to increase researcher engagement on our programsWeb Application Firewall and Rate Limiting

— expand coverage and tune new rules while coordinating with developers, support team members, and the site reliability teamRemediation

— enable and encourage developers to correctly fix recently discovered security issues in a timely manner, ultimately reducing our Mean Time To RemediateSecure Software Development Lifecycle

— configure automated tooling (eg. static and dynamic code analysis,, IAST) in our SDLC to detect security issues in our source code before it reaches productionDeveloper Education, Security Culture

— create fun ways to spread technical security awareness throughout the engineering departmentIncident response

— lead or assist in running the various phases of an incident response, including initial detection, triage, containment, recovery, root cause analysis, retrospective, etc.Collaboration with the infrastructure security team

— pair with members of the infrastructure security team on various projects to secure our cloud instances and employee workstationsCollaboration with the compliance and privacy team

— help ensure that our company complies with industry best practices and standardsProcess improvements

— help strengthen our own internal processes and proceduresA typical day will look like:Engage with one or more product development teams and guide them through a threat model and data flow analysis.Review the code for major new functionality to ensure security best practices are followed.Review new tickets in our bug bounty program ( and use your system design and threat modeling knowledge to reproduce, define risk and mitigating controls and propose a fix.,A call or two with Development, Product Management teams to discuss security-related issuesPen test a new feature in a staging environment with Burp ProAssist the compliance team on a privacy-related projectProvide technical advice in response to occasional questions from developers and other members of the security teamSkills and knowledge you should possess:Required: 5+ years of prior experience in either software development, devops, or site reliability engineering with hands-on coding experience.Preferred: prior experience in Application Security7+ total years of relevant experience in Engineering, Application Security, or a similar technical field.Strong knowledge of modern web, mobile, and network securityStrong programming skills with at least one of the following languages, and the ability to read all of them: Python, Go, PHP, Javascript, and RubyExpertise with application pen testing, using tools like Burp or ZapConfident working in and across cloud environments like AWS and GCP. Detailed knowledge of at least one cloud environment.Confident with shell scriptingConfident with common SDLC components, like git, Jira, Jenkins, etcConfident ability to communicate technical security concepts to developersAt least an upper-intermediate level of EnglishBonus points:Link to a Github repo with security tools/scripts you’ve developed or help maintainFull-stack web development experience creating RESTful applications (in any language) is a big plusOpen source vulnerability research or blog posts is a big plusSExperience with system security hardening guidelines and SDLC principlesAbout Us:Vimeo (NASDAQ: VMEO) is the world's most innovative video experience platform. We enable anyone to create high-quality video experiences to better connect and bring ideas to life. We proudly serve our community of millions of users – from creative storytellers to globally distributed teams at the world's largest companies – whose videos receive billions of views each month. Learn more at is headquartered in New York City with offices around the world. At Vimeo, we believe our impact is greatest when our workforce of passionate, dedicated people, represents our diverse and global community. We’re proud to be an equal opportunity employer where diversity, equity, and inclusion is championed in how we build our products, develop our leaders, and strengthen our culture.

  • Principal Security Engineer

    5 days ago

    Bengaluru, India HERE Technologies Full time

    What's the role?Key Functions:Lead a team of 2 SOC analysts/engineers covering the APAC region for a follow-the-sun SOC Operations.Oversee and actively participate in Detection/Monitoring activities, continuously monitoring network traffic and security alerts for potential threats and vulnerabilities.Develop and implement robust incident response plans,...

  • Principal Security Engineer

    6 days ago

    Bengaluru, India HERE Technologies Full time

    What's the role? Key Functions:  Lead a team of 2 SOC analysts/engineers covering the APAC region for a follow-the-sun SOC Operations. Oversee and actively participate in Detection/Monitoring activities, continuously monitoring network traffic and security alerts for potential threats and vulnerabilities. Develop and implement robust incident...

  • Netwitness-Software Principal Engineer

    2 weeks ago

    Bengaluru, India RSA Security Full time

    Netwitness-Software Principal EngineerAs one of the most established cybersecurity companies in the world, we at NetWitness are hard at work every day helping our customers and partners better protect their organizations from cyberattacks. Our products and incident response services are used within most large enterprises, governments and militaries for...

  • Netwitness-Software Principal Engineer

    2 weeks ago

    Bengaluru, India RSA Security Full time

    Netwitness-Software Principal Engineer As one of the most established cybersecurity companies in the world, we at NetWitness are hard at work every day helping our customers and partners better protect their organizations from cyberattacks. Our products and incident response services are used within most large enterprises, governments and militaries for...

  • RSA - Application Security Engineer

    2 weeks ago

    Bengaluru, India RSA Security Full time

    RSA - Application Security Engineer Location: Remote India RSA offers mission-driven security solutions that provide organizations with a unified approach to managing digital risk that hinges on integrated visibility, automated insights and coordinated actions. RSA solutions are designed to effectively detect and respond to advanced attacks; manage...

  • Principal Application Security Engineer

    2 weeks ago

    Bengaluru, India Vimeo, Inc. Full time

    Principal Application Security EngineerYou’ll plan, carry out, and lead security initiatives to monitor and protect sensitive data and systems from infiltration and cyber-attacks.You love to solve puzzles, and are a great team player.This role is remote.The expected hours are:Summer months (second Sunday in March thru first Sunday in November): 1:30 PM -...

  • Principal Applications Engineer

    2 months ago

    Bengaluru, India NI Full time

    Principal Applications Engineer – Automotive & Transportation (India)  The JKAI (Japan, Korea, ASEAN, and India) Customer Engagement Team in the NI TBU CCS (Transportation Business Unit, Customer Centric Solutions) organization under Test and Measurement business group in EMERSON has an immediate opening for a Principal Applications Engineer in...

  • Principal Product Security Engineer

    3 weeks ago

    Bengaluru, Karnataka, India TIBCO Software India Pvt Ltd Full time

    Apply for Principal Product Security Engineer, Career Progress Consultants in Bengaluru/ Bangalore for Year of Experience on

  • Principal Software Engineer

    5 days ago

    Bengaluru, India New Relic, Inc. Full time

    Principal Software Engineer - Security ProductsPrincipal Software Engineer - Security ProductsPrincipal Software Engineer Req ID FY|R&D|#5 Location(s) Bangalore, India; Hyderabad, India; Work arrangement(s) Hybrid (works from home and New Relic office throughout the week) Your opportunity Interested in helping developers around the world improve the security...

  • RSA- Software Principal Engineer- Full Stack Java Developer

    2 weeks ago

    Bengaluru, India RSA Security Full time

    RSA is the premier provider of security, risk and compliance management solutions for business acceleration. RSA helps the world's leading organizations solve their most complex and sensitive security challenges. These challenges include managing organizational risk, safeguarding mobile access and collaboration, proving compliance, and securing virtual and...

  • Netwitness - Software Senior Engineer

    1 week ago

    Bengaluru, India RSA Security Full time

    Job Title: Principal Software Engineer - Platform EngineeringLocation: BangaloreJob Type: Full-TimeJob Description:We are seeking a highly skilled and experienced Principal Software Engineer to join our Platform Engineering team. As a Principal Software Engineer, will play a critical role in shaping the technical direction of our platform infrastructure,...

  • Principal Engineer Network Security

    4 days ago

    Bengaluru, India News Corp Full time

    Job Description : We are seeking a highly skilled Principal Engineer specializing in Network Security to join our dynamic team. As a Principal Engineer, you will play a pivotal role in designing, implementing, and maintaining our network security infrastructure. You will collaborate with cross-functional teams to develop innovative solutions that...

  • Information Security Principal Architect

    1 month ago

    Bengaluru, India Amadeus Full time

    Job TitleInformation Security Principal ArchitectPosition : Information Security Principal ArchitectEDUCATION :• Computer Science or Engineering Master’s degree• Following certifications are a plus:o CEH, CASE, TOGAF, AZ-500, CSSLPExperience Required :Master's degree in Computer Science or related field, or equivalent.10-12 years of total experience...

  • Principal Security Engineer

    1 month ago

    Bengaluru, India Borneo Full time

    About the Job: Borneo is seeking a dedicated and hands-on Security Engineer who will work closely with cross-functional teams to develop innovative products that align with our commitment to protecting privacy and maintaining compliance in the use of ML and Generative AI. As a Principal Security Engineer, you will be instrumental in designing, implementing,...

  • Netwitness - Software Senior Engineer

    2 weeks ago

    Bengaluru, India RSA Security Full time

    Job Title : Principal Software Engineer - Platform Engineering Location : Bangalore Job Type : Full-Time Job Description : We are seeking a highly skilled and experienced Principal Software Engineer to join our Platform Engineering team. As a Principal Software Engineer, will play a critical role in shaping the technical direction of our platform...

  • Netwitness Product Senior Security Engineer

    2 weeks ago

    Bengaluru, India RSA Security Full time

    Responsibilities • Work on any number of security and identity related areas and products • Build systems for detecting anomalous activities within the product • Develops and administers software engineering procedures and training for vulnerability scans and static code analysis • Analyse vulnerability report of various SCA and SAST scan tools...

  • Information Security Principal Architect

    2 months ago

    Bengaluru, India Amadeus Full time

    Job TitleInformation Security Principal ArchitectPosition : Information Security Principal ArchitectEDUCATION :• Computer Science or Engineering Master’s degree• Following certifications are a plus:o CEH, CASE, TOGAF, AZ-500, CSSLPExperience Required : Master's degree in Computer Science or related field, or equivalent.10-12 years of total experience...

  • Senior Application Security Engineer

    4 weeks ago

    Bengaluru, India IQMATRIX INFOWAYS SOLUTIONS PRIVATE LIMITED Full time

    Principal Accountabilities :- Lead by example and independently perform all functions and services of the GIS AppSec team.- Conduct advanced web application, micro-services, API, cloud penetration tests of proprietary and 3rd party on-prem/cloud systems and applications.- Perform targeted manual security reviews at key points in the software development life...

  • Principal Software Engineer

    2 days ago

    Bengaluru, India Dell International Services India Pvt Ltd (7451) Full time

    IT Principal Software Engineer Be a part of a team that’s ensuring Dell Technologies' product integrity and customer satisfaction. Our IT Software Engineer team turns business requirements into technology solutions by designing, coding and testing/debugging applications, as well as documenting procedures for use and constantly seeking quality...

  • Application Security Engineer

    2 weeks ago

    Bengaluru, India LeadSquared Full time

    Key Responsibilities: Application security assessments Secure Code Review Cloud security assessments Vulnerability management Security Training and Awareness Automation and engineering Requirements 3 to 5 years‘ experience in Product Security, desirable to have 1+ years of software development experience. Experience in testing several complex web...