SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
inDrive is seeking a Senior Application Security Engineer to join its AppSec team. In this role, you will own end-to-end areas of the AppSec program, from security requirements and design reviews to production controls. You will partner with product, platform, and infrastructure teams on new architecture, AI systems, and the security of applications and services.
Key responsibilities include:
- Own one or more AppSec program areas end-to-end, including planning, risk assessment, and metrics.
- Run security design reviews and threat modeling for new features, services, and AI systems; defend security requirements at the architecture committee.
- Assess security of web, mobile, and API applications; identify vulnerability variants across services.
- Coordinate external security assessments and bug bounty findings, from triage through team remediation and verification.
- Design secure authentication and authorization between users, services, and internal tools with platform teams.
- Evaluate, pilot, and tune security tools; retain only those delivering real findings.
- Convert incidents and assessment results into lasting controls, policies, and secure defaults for developers.
- Consult development teams on complex security issues; participate in AppSec on-call rotation for Critical and High incidents.
This is a hands-on role for an engineer who reviews code and architecture, leads work across multiple teams, and makes security decisions grounded in data.
Requirements:
- Higher education in IT, preferably information security.
- Knowledge of mobile application security (Android and iOS), client-server trust, app integrity, and protection against bots and account takeover.
- Deep knowledge of web and API security: authentication/authorization flaws, SSRF, injections, business logic issues, and ability to find vulnerability variants across services.
- Strong understanding of identity and access: OAuth 2.0, OIDC, JWT, signing key rotation, mTLS, service-to-service authentication, and SSO.
- Understanding of AI/LLM security risks: prompt injection, excessive tool permissions, agent access to sensitive data; practical use of AI in security work.
- Practical understanding of cloud-native infrastructure: Kubernetes, containers, API gateways, and AWS.
- Experience in threat modeling and security design review of new features and architecture.
- Understanding of vulnerability management and risk: severity, SLA, compensating controls, and risk acceptance.
- Ability to read and review code in at least one language, preferably Golang.
- Track record of leading projects with two or more teams from requirement to verified fix; clear written English.
- Experience with secrets and key management, rotation, and credential leak response.
Nice to have:
- Knowledge of software supply chain security, dependencies, CI/CD pipelines, and source control platform hardening.
- Experience tuning SAST, DAST, and SCA tools for precision; ability to judge tools by noise and cost per real finding.
