SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Meesho is a leading Indian e-commerce platform democratizing internet commerce for consumers and enabling small businesses to succeed online. The security team is responsible for protecting millions of daily orders and maintaining zero-downtime resilience across the platform.
As a Security Engineer III, you will be an integral part of the security organization, owning security workstreams end-to-end across the product development lifecycle. Your responsibilities span multiple critical domains:
**Security Architecture & Threat Modeling:** Lead threat modeling and secure design reviews for complex, multi-service features. Partner with engineering teams to drive security requirements into production and contribute security expertise to architecture discussions, helping establish secure-by-default patterns adopted across teams.
**Application & Offensive Security:** Own and conduct advanced security assessments (VAPT) across web platforms, APIs, and mobile applications (iOS & Android), focusing on business-logic, authentication, authorization, and multi-tenancy vulnerabilities that automated tools miss. Plan and execute red team and purple team exercises, translating findings into durable architectural fixes rather than point remediations.
**Manual Code Review:** Perform in-depth manual and automated source code reviews to identify security-critical bugs. Work with developers to eliminate entire classes of vulnerabilities at the framework or platform level.
**DevSecOps & Automation:** Own integration, tuning, and scaling of security tooling (SAST, DAST, SCA, secret scanning, container scanning) in CI/CD pipelines. Design and build custom security tooling and automation that scales security across engineering teams. Contribute to supply-chain and pipeline-hardening initiatives.
**Cloud Security:** Drive security reviews and hardening of cloud-native workloads on AWS and Kubernetes/EKS, covering identity and access, tenant isolation, network controls, and secrets management.
**AI/LLM Security:** Contribute to securing Meesho's AI-powered features, including threat modeling of LLM and RAG integrations, prompt-injection and data-leakage controls, tenant isolation for AI features, and secure patterns for AI in the SDLC.
**Vulnerability & Bug Bounty Management:** Own vulnerability lifecycle and remediation tracking. Help run the self-managed bug bounty program including triage, researcher engagement, and driving fixes to closure.
**Security Metrics & Culture:** Define and track security metrics (coverage, remediation SLAs, mean time to remediate) to drive engineering behavior and prioritization. Act as a security subject matter expert for developers through secure-coding guidance and code reviews. Mentor junior security engineers (SE1/SE2) and help level up the team's technical depth. Drive security culture initiatives including Security Champions programs, developer awareness, and phishing simulations. Contribute to risk and compliance efforts such as ISO 27001 readiness, TPRM, and BCP/BIA.
**Requirements:**
- 5-7 years of hands-on experience in product security or application security with a demonstrated track record of owning security workstreams end-to-end
- Bachelor's or Master's degree in Computer Science, Information Security, or a related field (preferred)
- Proven ability to lead threat modeling sessions and drive findings into the SDLC across cross-functional teams
- Strong proficiency performing security assessments on web applications and APIs, with deep command of OWASP Top 10 (Web and API) and complex authentication, authorization, session management, and business-logic vulnerabilities
- Hands-on manual source code review experience with ability to read and reason about code in Java, Node.js, Python, and React
- Demonstrated experience with DevSecOps, integrating and tuning security tooling in CI/CD pipelines, and building custom security automation
- Proficiency with cloud security on AWS or GCP, including native security tooling, and working knowledge of Docker and Kubernetes security
- Demonstrated experience planning and executing red team or purple team exercises, translating real-world attack paths into concrete defensive improvements
- Working knowledge of mobile application security assessments for Android and iOS, familiarity with OWASP MASVS framework and mobile-specific vulnerabilities, exposure to tools such as Frida, Objection, Drozer, and MobSF
- Strong analytical and problem-solving skills with sound judgment on risk prioritization at scale
- Excellent communication skills with ability to explain complex security issues to both technical and non-technical audiences and influence engineering decisions without direct authority
- Ability to mentor and uplevel earlier-career security engineers
**Bonus qualifications:**
- Relevant certifications such as OSCP, OSWE, GWAPT, or CKS
- Active participation in public or private bug bounty programs, published CVEs, or security research
- Experience speaking at meetups or conferences
- Exposure to AI/LLM security (prompt injection, RAG security, OWASP LLM Top 10) and software supply-chain security
- Exposure to India regulatory requirements such as the DPDP Act and CERT-In directions
