7 hours ago
Pune, IndiaStaff+
Responsibilities
- Architect and embed AI-driven security controls, including SAST, DAST, SCA, container security, and secrets detection, into CI/CD pipelines and developer workflows.
- Develop operational and strategic security practices for product-facing generative and agentic AI features.
- Conduct threat modeling for core services and complex AI architectures, including MCP, autonomous agents, tool-calling interfaces, multi-agent communication, prompt injection, and memory or context poisoning risks.
- Review Python, Go, and JavaScript code, triage findings, and partner with engineering teams on short- and long-term vulnerability remediation.
- Manage third-party open-source risks, dependency tracking, SBOMs, and secure MCP or agent-server ecosystems.
- Lead secure-coding workshops, train developers on secure AI usage, and grow the Security Champions network.
- Partner with engineering leadership, Information Security, GRC, BuildOps, and DevOps teams to secure Druva’s SaaS products.
Requirements
- 6–10 years of product security engineering experience in a SaaS environment and a record of technical leadership.
- Deep expertise in OWASP Top 10, CWE 25, threat modeling, cryptography, container security, and secure SDLC frameworks such as SAMM and Microsoft SDL.
- Hands-on experience with AI-first SDLC practices, agentic AI security, MCP security, and LLM security controls.
- Experience using AI tools for security workflows such as root-cause analysis, threat-model assistance, and automated policy generation.
- Proficiency in code review and scripting with Python, Go, or JavaScript; hands-on development experience is a major plus.
- Hands-on experience with Burp Suite, Snyk, OWASP ZAP, and CI/CD security scanners.
- Bachelor’s degree in computer science or information technology, or equivalent experience.
- OSCP, OSWE, CSSLP, or GIAC certifications and contributions to communities such as OWASP, BSides, NullCon, or Black Hat are preferred.
Tech Stack
Categories
About Druva
Druva builds a cloud-native SaaS platform for enterprise data protection, backup, and cyber recovery across cloud, SaaS, on-premises, endpoints, and edge environments. Offered by subscription, the Druva Resilience Cloud runs on AWS and provides air-gapped, immutable backups with disaster recovery and governance capabilities. Founded in 2008 and headquartered in Santa Clara, the privately held company serves nearly 7,500 customers, including 75 of the Fortune 500.