About the Role:

We’re a growing SaaS startup building our security team from the ground up. We’re looking for a hands-on Product Security Engineer who enjoys breaking things (responsibly) and helping teams fix them fast.

This role is very practical and impact-driven. You’ll be embedded close to the product and engineering teams, proactively attacking our own systems before anyone else does. If you like moving fast, owning problems end-to-end, and thinking like a real attacker, this role is for you.

What You'll Do:

• Actively test our SaaS product for security vulnerabilities across web apps, APIs, and cloud infrastructure.
• Perform manual security testing and targeted penetration tests (beyond automated scanners).
• Implement and help implement automated security test suites.
• Identify abuse cases, business logic flaws, and real-world attack paths.
• Work directly with engineers to reproduce issues and drive fixes.
• Help introduce lightweight security practices into the development process (threat modeling, secure design reviews).
• Validate fixes and ensure issues are fully resolved.
• Stay current on new vulnerabilities, attack techniques, and SaaS-relevant threats.

What You'll Bring:

• 5+ years of experience in application security, offensive security, or penetration testing.
• Strong understanding of web and API security (OWASP Top 10, auth, sessions, access control).
•  Experience testing modern SaaS products.
• Comfort working in cloud environments (AWS / GCP / Azure at a practical level).
• Experience with common security testing tools (Burp Suite, Nuclei, etc.).
• Ability to communicate findings clearly and pragmatically to engineers.
• Self-starter mindset — comfortable operating with limited process and high ownership.

Preferred, but not required:

• Startup experience or early-stage product exposure.
• Bug bounty or responsible disclosure experience.
• Secure code review experience (any major language).
• Familiarity with CI/CD and modern SDLC security.
• Offensive security certifications (OSCP, GWAPT, etc.).

Head - Programmatic Buying (Performance Solution) - APAC

Key Responsibilities 

Portfolio & Revenue Ownership

• Own and drive revenue (MF and NR with focus on NR) across the India, SEA, Japan, Korea and ANZ
• Distinguish and manage the levers that drive Media Flow growth (scale, spend efficiency, campaign volume) along with those that drive Net Revenue improvement (margin management, solution mix, pricing) 
• Identify, call out, and mitigate revenue risks proactively across both dimensions; bug stops at this level 
• Own regional performance planning — forecast, pacing, and corrective actions 
• Navigate cross-regional dynamics and connect learnings across Americas, EMEA, and China to unlock portfolio-wide revenue growth 

• Manage, grow, and develop L1–L4 traders across functional and professional dimensions 
• Assign portfolios based on team capability mapping; enable traders to operate at the edge of their level and develop professionally 
• Foster an experimentation and hypothesis-driven culture within the team 
• Drive tough conversations within the team and with external stakeholders when necessary 

• Define and govern the analytical frameworks used across the trading function 
• Identify new avenues for growth from data-driven approaches and strategic thinking for long term 
• Build processes to drive efficiency in execution with a mindset of growing dollars managed per person – through automation, AI and alignment – and ensure adherence to processes 
• Think outside existing playbooks; conduct experiments and hypothesis-led research on unsolved problems 

Platform & Product Influence

• Work closely with Product, SE, Engineering, Data science and other teams to align platform priorities to the reality of advertiser needs 
• Translate ground-level trading signals and advertiser feedback into actionable product roadmap inputs 
• Drive experimentation across DSP and partner platforms; evaluate hypothesis impact rigorously 
• Influence platform decisions using evidence from portfolio-scale observations across multiple regions so that we are building for a global strategy 

• Align with Sales, CGM, Strategy, Ops, Creative, etc. on regional ops playbooks, GTM execution, and trading requirements across Americas, EMEA, and China 
• Work with senior commercial leadership to unlock blockers from clients and ensure product attention tracks to account priority 
• Represent trading in cross-functional discussions; bring market and industry intelligence to inform decision-making 
• Maintain awareness of competitive landscape and emerging performance marketing trends by region 

Customer Centricity

• Obsess over customer needs (KPIs, Delivery and Fraud controls) and put customer first – and everything else after mindset to work and instill that culture within the team 
• Maintain deep contextual knowledge of key accounts: spend stack rank, KPIs, competitive landscape, title/app lifecycle, and partner footprint 
• Ensure product and trading approaches are grounded in advertiser unit economics — avoid over-generalizing across diverse advertiser types 
• Set and push uncomfortable goals for the team in terms of account penetration and vertical expansion with growth mindset 

• Establish a culture of daily tracking, structured RCAs, and follow-through across the team 
• Drive accountability not just in performance but in how issues are raised, escalated, and resolved 
• Personally accountable for regional growth outcomes; cascades that accountability through the team 

Qualifications & Experience 

Required 

• 10+ years of experience in performance marketing, or ad tech; 3+ years in analytics, account management, delivery capacity 
• Deep expertise in DSP mechanics, attribution frameworks, and MMP integrations (Appsflyer, Adjust, Kochava) 
• Demonstrated ability to manage, mentor, and grow a trading team across multiple levels 
• Track record of driving advertiser revenue growth at portfolio scale 
• Experience working across multiple regions with an understanding of regional dynamics across different regions – understand nuances for each but able to connect them in one thread if needed 
• Comfort navigating cross-functional stakeholder environments (Sales, CGM, Product, Tech, Partnerships, Finance, Ops) 

Preferred 

• Exposure to multi-solution portfolios including such as DSP, On-Device, Affiliate, etc.  
• Familiarity with agency-model orchestration (not just direct managed delivery) 
• Experience influencing product roadmaps based on trading data and advertiser feedback 
• Prior exposure to vertical-specific performance marketing (gaming, fintech, e-commerce, OTT/streaming) 

Glean is looking for an Application Security Engineer with a primary focus on ensuring that our entire technology stack is free of software vulnerabilities (CVEs). This role is responsible for securing our base OS images, ensuring all open-source software (OSS) dependencies are scanned and patched, and integrating cutting-edge security tools into our CI/CD pipeline. The ideal candidate will drive the adoption of solutions like Google’s Assured Open Source Software (OSS) and explore alternative approaches to enhance software security.

You will:

• Implement and improve the vulnerability management lifecycle, ensuring our entire tech stack is free from known vulnerabilities/CVEs.
• Continuously scan, monitor, and patch OSS dependencies to mitigate supply chain risks and enforce best practices for dependency management.
• Work closely with engineering teams to integrate state-of-the-art SAST, DAST, and dependency scanning tools into the CI/CD pipeline to detect and remediate vulnerabilities early.
• Define and maintain best practices for secure coding to ensure all code developed by Glean engineers is free from vulnerabilities.
• Ensure secure posture in SDLC by securing designs, conducting secure code reviews and penetration testing the features.
• Develop automated security validation tests to enforce vulnerability-free deployments across the stack.
• Lead the adoption and, if necessary, develop custom security solutions to manage and mitigate security risks at scale.
• Provide security guidance, training, and mentorship to engineering teams to foster a security-first culture at Glean.

About you:

• BA/BS in Computer Science, Cybersecurity, or a related field (or equivalent industry experience).
• 5+ years of experience in application security and vulnerability management.
• Deep understanding of software security vulnerabilities, including CVEs, OWASP Top 10, and supply chain risks.
• Deep understanding security design principles including but not limited to authentication, authorisation, RBAC, database security.
• Experience with SAST, DAST, dependency scanning, and vulnerability management tools (e.g., Snyk, GitHub Dependabot, Trivy, Clair, Burp Suite, OWASP ZAP).
• Strong familiarity with package managers (npm, pip, Maven, Go modules) and securing open-source dependencies.
• Coding experience in languages such as Go, Python, Java, or C++ to develop security test cases and tooling.
• Hands-on experience with cloud-native security best practices across AWS, GCP, or Azure.
• Knowledge of container security, Kubernetes security, and securing microservices architectures.
• Ability to lead cross-functional initiatives and drive security adoption within engineering teams.
• A strong proactive approach to security, identifying risks before they become problems.
• Excellent problem-solving skills and the ability to balance security with performance and usability.
• Experience working in fast-paced, highly collaborative environments where security is a shared responsibility.
• Passion for open-source security and keeping up with the latest trends in software vulnerability management.

Location:

• This role is hybrid (3 days a week in our Bangalore office)

Compensation & Benefits:

Compensation offered will be determined by factors such as location, level, job-related knowledge, skills, and experience. Certain roles may be eligible for variable compensation, equity, and benefits.

We are a diverse bunch of people and we want to continue to attract and retain a diverse range of people into our organization. We're committed to an inclusive and diverse company. We do not discriminate based on gender, ethnicity, sexual orientation, religion, civil or family status, age, disability, or race.

#LI-HYBRID

Job summary

We're looking for a Senior Penetration Testing Engineer to conduct comprehensive security assessments and support our digital trust initiatives. You'll perform hands-on penetration testing across our applications, infrastructure, and services while contributing to our organization's security posture and customer trust commitments.

What you will do

• Help establish and mature our penetration testing program, methodologies, and standard operating procedures
• Build relationships with stakeholders across product, engineering, and compliance teams
• Create detailed testing reports and security recommendations
• Support risk assessment activities and security control validation
• Conduct comprehensive penetration tests against web applications, APIs, and mobile applications
• Perform network penetration testing and infrastructure security assessments
• Execute social engineering assessments and physical security evaluations
• Test cloud environments and containerized applications for security vulnerabilities
• Conduct red team exercises and adversarial simulations
• Perform threat modeling and attack surface analysis for critical systems
• Support digital trust initiatives and regulatory compliance requirements through security validation testing
• Contribute to security certifications, audit processes, and customer trust commitments
• Assess third-party integrations and vendor security postures

What you will have

• 5+ years in penetration testing, ethical hacking, or offensive security
• Previous experience with standing up a penetration testing program
• Strong knowledge of web application security testing (OWASP methodology)
• Experience with network penetration testing tools and techniques
• Proficiency with testing frameworks (Metasploit, Burp Suite, Nmap, etc.)
• Understanding of cloud security across AWS, Azure, or GCP platforms
• Knowledge of compliance frameworks (SOC 2, PCI DSS, ISO 27001)

Nice to have

• Security certifications (OSCP, CISSP, CEH, GPEN, GWEB)
• Background in digital trust, privacy, or regulatory compliance
• Red team or adversarial simulation experience
• Scripting and automation skills (Python, PowerShell, Bash)

Benefits

• Generous time off policies
• Top shelf benefits
• Education, wellness and lifestyle support

#LI-SS1

Lead Security Engineer

Couchbase — Bangalore, India | Information Security | Full-Time

About Couchbase

As industries race to embrace AI, traditional database solutions fall short of rising demands for versatility, performance, and affordability. Couchbase is leading the way with Capella, the developer data platform for critical applications in our AI world. By uniting transactional, analytical, mobile, and AI workloads into a seamless, fully managed solution, Couchbase empowers developers and enterprises to build and scale applications with unmatched flexibility, performance, and cost-efficiency—from cloud to edge. Trusted by over 30% of the Fortune 100, Couchbase is unlocking innovation, accelerating AI transformation, and redefining customer experiences. Come join our mission.

The Role

We are seeking a driven and versatile Lead Security Engineer to join Couchbase's global Information Security team as our first security hire in Bangalore. This is a unique opportunity to be foundational to Couchbase's 24x7 security coverage and grow alongside a world-class security organization.

You will be a broad contributor—supporting and partnering our Security Operations, GRC, Product and Application Security teams. Working closely with Engineering, Cloud, and GTM functions, you'll gain hands-on exposure across the full security lifecycle. This role is ideal for someone who thrives across disciplines, moves between strategic and tactical work with ease, and wants to help build something meaningful from the ground up.

As Couchbase's security presence in Bangalore grows, you will be instrumental in expanding timezone coverage for security monitoring, incident response, and compliance operations—serving as a key link in our global, follow-the-sun security model.

Key Responsibilities

Security Operations

• Lead and own the timezone-extended coverage for security monitoring, alert triage, and initial incident response as the primary regional point of contact for the global security model.
• Drive day-to-day security operations including threat detection, monitoring, and escalation using SIEM and other security tooling.
• Assist with vulnerability management workflows—identification, prioritization, and tracking remediation in collaboration with engineering and cloud teams.
• Contribute to the review and improvement of existing security processes and tooling, including SIEM, DLP, endpoint security, email security, and vulnerability management platforms.
• Support security incident response planning and execution, interfacing with Engineering, Cloud, and SOC teams during active incidents.
• Help maintain and improve business continuity and disaster recovery documentation and runbooks.

Governance, Risk & Compliance (GRC)

• Contribute to GRC activities by focusing on audit evidence collection, documentation, and the continuous improvement of policies/standards under GRC team guidance.
• Assist with compliance initiatives including SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CCPA, and other relevant frameworks.
• Help track and document security risks, control exceptions, and remediation plans across the enterprise.
• Contribute to audit evidence collection and documentation to support external assessments and certifications.
• Support privacy-by-design efforts, including data privacy assessments and alignment with evolving global data regulations.
• Assist in building governance frameworks for AI/ML workloads and data pipelines, ensuring responsible and compliant adoption of AI technologies.

Product & Application Security

• Provide support for Product/AppSec enablement efforts by assisting with the integration of application security tooling (SAST, DAST, SCA) into CI/CD pipelines.
• Partner with Product Security engineers in conducting security architecture reviews and threat modeling for Couchbase's Capella cloud platform and database products.
• Support the execution of static and dynamic code scan reviews and assist with triaging and tracking findings.
• Contribute to the management of Couchbase's bug bounty program, including triage, validation, and researcher communication.
• Assist with the planning and coordination of application penetration tests and tracking remediation of findings within defined SLAs.
• Help engineering teams understand and apply secure coding principles, including OWASP Top 10 and OWASP SAMM.
• Assist in completing security sections of RFP questionnaires and customer security reviews.

Cross-Functional Collaboration

• Build strong working relationships with Engineering, Product, Cloud, Legal, and Compliance teams to support security initiatives across the organization.
• Work with customers as needed to explain security policies or address product-related security questions.
• Champion a "security is everyone's job" mindset and help embed security into Couchbase's engineering-driven culture.
• Contribute to security metrics and reporting to help track maturity and drive continuous improvement.

Qualifications

Required

• 6–9 years of hands-on experience in information security spanning two or more domains: GRC, product/application security, or security operations.
• Working knowledge of major compliance frameworks (SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CCPA).
• Familiarity with application security principles including OWASP Top 10, threat modeling, SAST/DAST tooling, and secure SDLC practices.
• Practical experience with public cloud security on at least one of AWS, Azure, or GCP.
• Experience with security tooling such as SIEM (Splunk, Rapid7, AlienVault), endpoint security (SentinelOne, CrowdStrike), or DLP platforms (Netskope, Proofpoint).
• Strong written and verbal communication skills with the ability to collaborate effectively across engineering, product, and business teams.
• Growth mindset, intellectual curiosity, and a genuine desire to broaden expertise across multiple security disciplines.

Nice to Have

• Experience with bug bounty program management, penetration test coordination, or vulnerability management.
• Familiarity with CNAPP tools (Wiz, Sysdig, Prisma Cloud) or cloud-native security tooling.
• Understanding of IAM, key management, encryption, and network security fundamentals.
• Experience with MDM tools (Kandji, Jamf, WorkspaceOne) and automating workflows/processes.
• Hands-on experience working within a GRC function on audits, risk assessments, or policy management.
• Exposure to AI/ML security considerations or data governance in a cloud environment.
• Industry certifications such as Security+, CISSP, CISM, CEH, or equivalent.
• Bachelor's degree in Computer Science, Information Security, or a related field.

Why This Role

This is a rare chance to join a lean, high-caliber security team at a pivotal moment—both for Couchbase and for the Bangalore office. You won't be siloed. You'll work across GRC, product security, AppSec, and SecOps, learning from specialists in each domain while contributing meaningfully from day one. As the team grows, so will your scope and influence.

Couchbase is trusted by over 30% of the Fortune 100 to power mission-critical applications. Security isn't an afterthought here—it's foundational to everything we build.

What does the team do? 

Opportunity is part of the evolving cyber security group which is laser focussed on setting up industry benchmarks in managing & guarding against digital risks in a “Cloud Native - DevOps Only” AI environment. It is a lean-mean-special action group where every cyber sentinel gets an opportunity to work across domain, has an independence to challenge status quo & evolve cyber practices to next level of maturity. Our core competencies revolve around “Product & Platform security” , “Cloud Native Risk Management” and “Detection & Response”.

What you will be doing? 

Application Security Testing & DevSecOps

• Perform application security testing across Web, API, Mobile (Android & iOS), TV and Cloud services, including vulnerability assessments and penetration testing.
• Validate and triage security findings through exploit verification and risk‑based severity assessment.
• Own and operate CI/CD security controls, including SAST, DAST, SCA, secrets scanning, and IaC scanning.
• Build and maintain security gates (e.g., Chekmarx or equivalent) with a focus on automation, accuracy, and developer usability.
• Conduct manual security code reviews for APIs and services written in Java, Python, and Node.js.
• Review application designs for authentication, authorization, data protection, and API security best practices.
• Automate security workflows using scripts and APIs to standardize testing and reduce manual effort.
• Partner with engineering teams to drive timely, risk‑appropriate remediation and prevent repeat vulnerabilities.

AI / GenAI Security

• Apply AI Secure SDLC practices for LLM-based features, including prompt design, tool/function usage, and safe integration patterns.
• Assess and mitigate OWASP LLM Top 10 risks.
• Review and maintain secure prompt templates, including system prompt hardening and context scoping.
• Implement practical AI guardrails (output validation, policy checks, basic jailbreak and abuse detection).
• Perform AI red teaming and adversarial testing using tools such as Garak, PyRIT, and custom test cases.
• Review RAG implementations to ensure authorization-aware retrieval, tenant isolation, and reduced data leakage risk.
• Identify and reduce sensitive data exposure risks in embeddings and ingestion pipelines.
• Conduct AI-focused threat modeling using OWASP LLM Top 10, STRIDE, and MITRE ATLAS as reference frameworks.

What We’re Looking For (Required)

• Minimum 7 years of experience in Application Security, Penetration Testing, DevSecOps, or Security Engineering.
• Proven hands-on ability with SAST/DAST/SCA, CI/CD security gates, and vulnerability triage/remediation workflows.
• 2–3 years’ experience building and managing security gating in Checkmarx (or equivalent).
• 2–3 years’ experience performing manual security code review (APIs/services; common languages: Java/Python/Node.js).
• Familiarity with OAuth2, OIDC, JWT, mTLS, API gateways, and service-to-service identity.
• Strong knowledge of OWASP Top 10 Mobile, OWASP Top 10 LLM.
• Strong experience with common testing tools: Burp Suite, OWASP ZAP, SQLMap, Kali (and similar).
• Scripting/automation skills using Python, plus Bash/PowerShell familiarity.
• Working knowledge of Docker/Kubernetes, cloud-native patterns, and secrets management basics.
• Solid communication skills—ability to write clear findings, influence engineering decisions, and partner effectively.

AI-Specific Technical Skills (Expected Competency)

• Hands-on familiarity with LLM integrations and Python AI ecosystems (e.g., LangChain / orchestration frameworks).
• Understanding of RAG pipelines and vector database concepts (e.g., Pinecone, FAISS, Milvus or equivalent).
• Ability to design/validate guardrails (policy allow/deny, jailbreak detection, output validation, safe tool calling).
• Familiarity with AI security testing patterns (prompt injection testing, data leakage testing, agent/tool abuse testing).

Preferred / Nice-to-Have

• Bug bounty / responsible disclosure recognition (Hall of Fame, awards).
• Experience deploying and scaling open-source security tools in production.
• Certifications: OSCP, OSCE, GWAPT, GPEN, CSSLP
• Any AI security-focused training (LLM security, RAG security, adversarial testing, ATLAS/LLM Top 10 programs).