Lead Security Engineer - Application Security

groww - Bengaluru, Karnataka
Job Description

Company Vision
We are making finance simple. For millions in India.
Groww is on a mission to democratize access to financial services for millions of Indians responsibly. We are a customer-first company. We believe in crafting the best and most delightful user experience for our customers. And we leverage first principle thinking and technology to solve problems at scale. If this excites you, join us.
About Groww
Groww is India’s fastest growing investment platform. Our long term vision to become the trusted money partner of ~100M Indians with core products in investment & banking. Groww was founded in 2016 by alums from Flipkart, ICICI, IITB, IITD, BITs Pilani and is , backed by marquee investors like Tiger Global, Sequoia Capital, Ribbit Captial, and Y Combinator.
Our Values
We take pride in our values and hold ourselves to a high standard on:
Radical customer centricity
Simplicity in our products and personalities
Transparency on everything
Long term thinking
Ownership driven culture
Essential Responsibilities:
Assess applications and products for security vulnerabilities and design flaws
Performing Web application security testing, Mobile(Android/iOS) application security testing and Secure code review
Interact with project teams to understand the security requirements and taking ownership of pods
Performing Product Requirement reviews, Threat modelling, Static Code Reviews and cloud security assessments
Evaluate security vulnerabilities and prioritise remediation efforts
Think out of the box in building attack scenarios
Provide technical guidance to developers on secure coding practices
Evaluate and improve application security tools and processes
Research latest security best practices, staying current on new vulnerabilities and threats
Knowledge and Skills Required:
Security understanding across web, mobile and client server applications is a must
Inclination towards learning multiple areas of security and building competency to deliver a wide spectrum of security like cloud security, devSecOps etc.
Experience in performing automated security testing using static and dynamic scanning tools
Experience in performing manual code reviews and penetration testing
Knowledge of applicable industry standards, leading security practices and regulatory requirements
Deep understanding of cryptography, authentication, authorisation, network security protocols and web application security
Strong exposure to popular application security standards including OWASP TOP 10, SANS TOP 25 etc.
Proficient in Java programming language. Knowing python, shell scripting is add-on.
Strong interpersonal skills as well as excellent written and verbal communication skills
Uncompromising personal and professional integrity and ethics
Certifications are not mandatory but skills are.