Application Security Engineer

Company Description 5Exceptions Software Solutions Pvt Ltd is an offshore software development company specializing in building high-quality products, websites, and mobile applications for global clients. Founded in 2015 by a team of experienced technologists, the company delivers solutions across domains such as Finance, Healthcare, and E-commerce using a wide range of modern web, mobile, cloud, and enterprise technologies. The team includes skilled project managers, software developers, and quality assurance professionals who focus on reliable, timely delivery. 5Exceptions empowers businesses through digital transformation, simplifying complex processes and creating practical, effective solutions. The company’s technical expertise covers full-stack web and mobile development, QA automation, CRM platforms, cloud services, and emerging technologies like blockchain, IoT, and chatbots.
Job Title: AppSec / AI Security Engineer
Employment Type: Full-time/ Permanent
Location: Indore (Work from Office)
About the Role
We're embedding security and AI governance into the core of our software development lifecycle. This role owns the design and implementation of automated security scanning, code provenance, and governance processes to ensure AI-generated code meets the highest security and compliance standards.
If you're a self-driven engineer who enjoys building security automation from the ground up and weaving security seamlessly into development pipelines, this role is for you.
Key Responsibilities
Build and integrate security controls into CI/CD pipelines — including automated scanning for source code, dependencies, secrets, and Infrastructure as Code (IaC) — with enforcement gates on every merge.
Design and implement code provenance tracking to capture AI-generated code, the AI models used, and reviewer approvals as part of the development pipeline.
Develop structured code review workflows incorporating specifications, scan results, and code provenance.
Optimize security scanning tools to reduce false positives and drive developer adoption.
Investigate and manage security findings using established remediation and documentation processes.
Contribute to AI governance standards, including secure usage of AI tools and governance of AI-generated code.
Conduct independent security reviews of internally developed, third-party, and vendor-supplied code to ensure compliance with security standards.
Required Skills & Experience
Strong hands-on experience in Application Security, with proven expertise securing CI/CD pipelines.
Experience implementing automated security scanning and enforcement — not just operating existing tools.
Strong knowledge of SAST, SCA, secret scanning, DAST, and IaC security scanning.
Strong understanding of cloud infrastructure, with hands-on or working knowledge of AWS and Azure, is preferred.
Ability to design, build, and own security automation and governance solutions from the ground up.
Strong judgment in balancing security with developer productivity by minimizing unnecessary alerts.
Excellent communication skills, with the ability to explain security risks in clear, business-friendly language.
Strong analytical mindset and ability to independently assess security risk across internal and external codebases.
Preferred Qualifications
~4+ years of experience in Application Security, Security Engineering, DevSecOps, or a related field.
Experience with AI-generated code security, LLM security risks, prompt injection, code provenance, or AI governance.
Hands-on experience with tools such as Semgrep, CodeQL, Snyk, Gitleaks, TruffleHog, Prowler, Trivy, or similar.
AWS certification (Solutions Architect Associate preferred), or willingness to obtain one within 90 days.
Security certifications such as OSCP, GWAPT, CSSLP, or equivalent.
Experience writing custom detection rules or security policies (e.g., custom Semgrep rules).

Work arrangement
No