3 months ago
Pune, IndiaSenior / Staff+
Responsibilities
- Embed application security controls into CI/CD pipelines to provide actionable feedback to engineers.
- Investigate, remediate, and validate application security findings, including managing exceptions and false positives.
- Conduct targeted code reviews with engineers and platform teams to identify security issues early.
- Implement and maintain security controls, integrations, and automations across applications and APIs.
- Perform threat modeling to identify abuse cases, threat actors, and preventative and detective controls.
- Collaborate with the METRO Corporate Information Security engineering community to define practices, prioritize activities, and improve security across application and API platforms.
- Mentor others and raise awareness of security mandates.
Requirements
- 7–11 years of security experience in application security or related areas.
- Experience identifying, investigating, and remediating vulnerabilities across the software development lifecycle.
- Hands-on experience writing and reviewing code and contributing to design reviews, planning, and implementation.
- Experience designing, implementing, and improving security tooling and CI/CD integrations, with a focus on reducing noise and prioritizing risk.
- Strong developer-experience focus and ability to communicate security issues clearly.
- Familiarity with monolithic and microservice-based application architectures.
- Understanding of OWASP Top 10, SAMM, ASVS, and FIRST principles.
- Comfort working with one or more programming languages such as Java, C++, Python, or JavaScript.
- Experience with LLMs, AI, and agentic coding platforms such as GitHub Copilot, Gemini, or Claude Code.
- Proven experience as a security subject-matter expert, including mentoring and raising awareness of security mandates.
Tech Stack
Categories
About METRO AG
METRO AG is a German wholesale company serving hotels, restaurants, caterers (HoReCa) and independent retailers via cash-and-carry stores and foodservice delivery. It operates in more than 30 countries with a network of stores and dedicated delivery depots, supported by global shared-service centers for IT, finance, and HR. Headquartered in Düsseldorf and established as METRO AG in 1996, it is a publicly listed business focused on professional B2B customers rather than consumers.