Senior Engineer - Application and Platform Security (India)

Juniper Square offers employees a variety of ways to work, ranging from a fully remote experience to working full-time in one of our physical offices. We invest heavily in digital-first operations, allowing our teams to collaborate effectively across 27 U.S. states, 2 Canadian Provinces, India, Luxembourg, and England. We also have physical offices in San Francisco, New York City, Mumbai and Bangalore for employees who prefer to work in an office some or all of the time.

About your role

As a Senior Engineer - Application and Platform Security on our Platform Engineering team, You’ll find and fix vulnerabilities across our applications and cloud infrastructure. Then you’ll build the guardrails, automation, and secure defaults that keep them from coming back. The role spans application code, build and deployment systems, cloud infrastructure, and our AI-powered features. It’s hands-on: you’ll write production-quality code, ship tools engineers want to use, and use AI agents to multiply your own output.

What you will do:

Application and product security (your focus)

Lead security design reviews and threat models for new product features, with depth in authentication, authorization, data isolation, and high-risk financial workflows.

Perform manual code review and security testing of web applications and APIs. Focus on the authorization and business logic flaws that scanners miss, and drive fixes through to verification.

Design secure-by-default libraries, framework-level controls, and custom static analysis rules that eliminate whole classes of vulnerabilities.

Triage application findings from automated and manual testing and external assessments. Group them by root cause and write remediation guidance engineers can act on.

Threat-model and test AI-powered product features against risks like prompt injection, unsafe tool use, data leakage, and excessive agency. Define secure patterns other teams can reuse.

Shared across the team

Share design review and triage responsibilities across the team.

Support our external penetration testing program, from scoping through retest.

Partner with teammates on build pipeline and supply-chain security, especially dependency risk in application code.

Participate in incident response for application security events.

Build security automation and agents that cut review and triage time.

Qualifications

Experience: 5+ years in application or product security, or in software engineering with a strong security focus.

Code review: Deep experience finding vulnerabilities through manual review. You find authorization and business logic flaws by reading code, not only by running a scanner.

Programming: Strong Python, plus working proficiency in JavaScript/TypeScript, enough to review front-end code for client-side issues. You write production-quality code, not just scripts.

Identity: In-depth knowledge of OAuth 2.0/OIDC, SAML, MFA, session management, and access control models, with hands-on experience implementing them securely.

Threat modeling: Experience leading threat modeling sessions with engineering teams and turning the output into concrete requirements.

Security tooling: Experience running and tuning SAST, SCA, and DAST, including writing custom rules.

Platform awareness: Working knowledge of cloud, container, and CI/CD security, enough to reason about how application design interacts with infrastructure.

AI security: A working understanding of LLM application risks and the drive to go deep.

Collaboration: Clear writing and a track record of influencing engineering teams without becoming a bottleneck.

Nice to have

An offensive web security background, such as bug bounty, web application CVEs, or CTFs. Certifications like OSWE or BSCP are a plus, not a requirement.

Experience building developer-facing security tooling or libraries.

Experience building or running a security champions program.

Familiarity with OWASP ASVS or the OWASP Top 10 for LLM Applications.