On-site opportunity at
MeeshoSecurity Engineer IV
Meesho's security group protects the company's products at every stage of development. The Security Engineer IV post in Bengaluru starts early: the engineer joins the threat…
Career Tools
About This Role
Meesho's security group protects the company's products at every stage of development. The Security Engineer IV post in Bengaluru starts early: the engineer joins the threat modeling sessions and design reviews to surface risks ahead of time, then sets up and runs static analysis tools inside the CI/CD pipeline so testing keeps pace as code changes. The engineer leads vulnerability scanning and penetration tests on web applications, APIs, iOS apps…
Job Description
Meesho's security group protects the company's products at every stage of development. The Security Engineer IV post in Bengaluru starts early: the engineer joins the threat modeling sessions and design reviews to surface risks ahead of time, then sets up and runs static analysis tools inside the CI/CD pipeline so testing keeps pace as code changes.
The engineer leads vulnerability scanning and penetration tests on web applications, APIs, iOS apps and Android apps, aiming to catch weaknesses before release. Other tasks include manual code reviews, hardening production systems, and operating a bug bounty program that the team manages itself.
The post also covers advising engineering and IT on security architecture, handling findings from pen tests and bounty submissions, delivering training and awareness sessions across the company, managing web application firewalls, joining the Security Champions program, and helping keep risk models up to date for newer and established platforms.
Applicants should bring seven or more years in product security, centered on application security and DevSecOps, with working knowledge of Python and Java, plus React and Node.js, experience securing CI/CD toolchains, and familiarity with AWS or GCP security services. This is an on-site role in Bengaluru.
Responsibilities
- Run the full secure software development lifecycle end to end
- Set up and operate security tooling inside CI/CD pipelines as part of DevSecOps
- Plan and lead penetration tests and vulnerability assessments for web, API, iOS and Android apps
- Run threat modeling, design reviews and architecture reviews
- Perform manual source code reviews and harden production environments
- Operate and grow a bug bounty program managed in-house
- Advise engineering and IT teams on security architecture
- Triage and close out issues raised by pen tests and bounty reports
- Lead security training and awareness work across the company
- Administer web application firewalls
- Participate in the Security Champions program and help maintain security risk models
Requirements
- Seven or more years in product security, emphasizing application security and DevSecOps
- Track record of driving structural changes or joint cross-team work to address security weaknesses
- Working skill in Python and Java, plus React and Node.js
- Hands-on time doing manual source code reviews and protecting live code
- Practical experience running protective tooling inside CI/CD pipelines
- Familiar with Git, Jenkins, Artifactory or comparable tools
- Solid grounding in secure SDLC practice and in removing whole classes of vulnerabilities
- Proficiency with AWS or GCP and their security tooling
Qualifications
- Experience with Docker and containerization, with infrastructure security on GCP as a bonus
- Credentials such as GWAPT or OffSec WEB-300 are a bonus
- Working understanding of SSO protocols such as OAuth and SAML
- Public talks at developer meetups or conferences count in your favor
- Experience in bug bounty programs
Core Skills
Benefits
- Broad medical insurance that extends to the employee's family
- MeeCare wellness program that addresses physical, mental, financial and social health, including telehealth and fitness perks
- Leave policies, parental support and retirement plans
- Funding support for learning and development
- Salary advances, relocation help and flexible benefit plans
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Where is the Security Engineer IV role located?
The role is on-site in Bengaluru.
How much experience is required?
Applicants need seven or more years in product security, leaning toward application security and DevSecOps.
Are certifications required?
No. Credentials such as GWAPT or WEB-300 are listed as bonus points.
Is the role full-time, and what is the salary?
The posting does not specify a salary.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.