The Role
Own application security program areas from requirements and threat modeling through production controls. Conduct web, mobile, API, architecture, and AI security reviews; coordinate assessments and bug bounty remediation; design authentication and authorization; tune security tools; establish secure defaults and controls; advise development teams; and respond to critical and high-severity incidents.
Summary Generated by Built In
We are looking for an Application Security Engineer in the AppSec team.
As a Senior Application Security Engineer at inDrive, you will own whole areas of our AppSec program, from security requirements and design reviews to controls that work in production. You will work with product, platform and infrastructure teams on new architecture, AI systems and the security of our apps and services. The role fits a hands-on engineer who reviews code and architecture, leads work across several teams and makes security decisions based on data.
Key Responsibilities
- Own one or more areas of the AppSec program end to end, including the plan, the risks and the metrics.
- Run security design reviews and threat modeling of new features, services and AI systems, and defend security requirements at the architecture committee.
- Assess the security of web, mobile and API applications and find variants of confirmed vulnerabilities across other services.
- Coordinate external security assessments and bug bounty findings, from triage and prioritisation with teams to fix verification.
- Design secure authentication and authorization between users, services and internal tools together with platform teams.
- Choose, pilot and tune security tools, and keep only those that pay off in real findings.
- Turn incidents and assessment results into lasting controls, policies and secure defaults for developers.
- Consult development teams on complex security issues and take shifts in AppSec duty for Critical and High incidents.
Skills, Knowledge and Expertise
- Higher education in IT, preferably in information security.
- Knowledge of mobile application security on Android and iOS, client-server trust, app integrity and protection against bots and account takeover.
- Deep knowledge of web and API security, including authentication and authorization flaws, SSRF, injections and business logic issues, and the ability to find variants of a vulnerability class across many services.
- Strong understanding of identity and access, OAuth 2.0, OIDC, JWT, signing key rotation, mTLS, service-to-service authentication and SSO.
- Understanding of security risks of AI systems and LLM agents, such as prompt injection, excessive tool permissions and agent access to sensitive data, and practical use of AI in your own security work.
- Practical understanding of cloud-native infrastructure, Kubernetes, containers, API gateways and AWS.
- Experience in threat modeling and security design review of new features and architecture.
- Understanding of vulnerability management and risk, including severity, SLA, compensating controls and risk acceptance.
- Ability to read and review code in at least one language, preferably Golang.
- Track record of leading projects with two or more teams from a requirement to a verified fix, and clear written English.
- Experience with secrets and key management, rotation and response to credential leaks.
Nice to have
- Knowledge of software supply chain security, dependencies, CI/CD pipelines and source control platform hardening.
- Experience tuning SAST, DAST and SCA tools for precision and judging a tool by noise and cost per real finding.
Why join us
- Help us challenge injustice by creating fair choices for millions of people across 47 countries.
- Develop your professional skills with access to mentoring, career consulting, and learning programs.
- Collaborate with teams around the world and gain international experience through our Global Talent Exchange Program.
- Engage in company-wide challenges, awards, sports activities, employee-led social impact and volunteering projects.
- Work alongside people who take initiative, speak openly, and challenge themselves to grow.
- Improve your language skills through co-financed courses and internal speaking clubs.
- Annual salary from 70 700 EUR gross.
Final benefits may vary depending on the location.
About
inDrive is a global tech company on a mission to challenge injustice through fair choices. We started in 2012 in the coldest city on Earth, when a group of friends created a way for people to agree on fair ride prices. That idea grew into one of the world’s top ride-hailing apps, now with 400M installs across 47 countries.Today, we offer more than rides: from freight and delivery to intercity travel and financial services, all designed to put people first. We are committed to having a positive impact on people’s lives both through our core business, which supports local communities via a fair pricing model; and through the work of our impact programs. Ready to ignite your inner drive?
Skills Required
- Higher education in IT, preferably information security
- Knowledge of Android and iOS mobile application security, client-server trust, app integrity, bot protection, and account takeover prevention
- Deep knowledge of web and API security, including authentication and authorization flaws, SSRF, injection, and business logic vulnerabilities
- Strong understanding of identity and access technologies, including OAuth 2.0, OIDC, JWT, signing key rotation, mTLS, service-to-service authentication, and SSO
- Understanding of AI and LLM agent security risks, including prompt injection, excessive tool permissions, and sensitive data access
- Practical understanding of cloud-native infrastructure, Kubernetes, containers, API gateways, and AWS
- Experience conducting threat modeling and security design reviews
- Understanding of vulnerability management and risk, including severity, SLAs, compensating controls, and risk acceptance
- Ability to read and review code in at least one programming language, preferably Golang
- Track record of leading projects across two or more teams from requirements through verified fixes
- Clear written English
- Experience with secrets and key management, rotation, and response to credential leaks
- Knowledge of software supply chain security, dependencies, CI/CD pipelines, and source control platform hardening
- Experience tuning SAST, DAST, and SCA tools for precision and evaluating noise and cost per finding
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
inDrive is a global IT and transportation platform inDrive is one of the world’s fastest growing online ride-hailing services. Its services are available in over 749 cities in 46 countries throughout the world. The Company’s app has been downloaded over 150 million times. inDrive offers other services, including intercity transportation, freight and cargo services, as well as delivery services in different markets of operations. inDrive is based in Mountain View, California, and operates regional hubs in the Americas, Asia, the Middle East, Africa and the countries of the CIS, and employs over 2,000 people. In early 2021, inDrive achieved unicorn status after closing a $140m investment round with Insight Partners, General Catalyst, and Bond Capital, which valued the company at $1.23 billion.
