DevSecOps & AppSecOps Engineer

Security Engineer: DevSecOps and AppSec

Location: Bangalore, India
Team: Security Engineering
Reports to: VP Security (Europe)

About HRS

HRS Group is a global B2B SaaS company redefining how enterprises manage travel, lodging, meetings, and workforce accommodation. Trusted by some of the world's largest corporations and public sector organizations, HRS operates across Europe, Asia, and the Americas, processing sensitive enterprise customer data, payment transactions, and PII at global scale across a cloud-native platform where AI agents develop, deploy, and operate software alongside human engineers.

This is not a legacy enterprise. HRS is actively building infrastructure where autonomous AI agents execute code, trigger deployments, and operate within production environments. The attack surface is real, the data is sensitive, and the customers are large enough to demand proof that it is protected.

About the Security Team

HRS is building its security function from a clean sheet, under explicit executive mandate to establish the highest security standards across the company and its product. The team operates a continuous security engineering model aligned to the NIST Cybersecurity Framework, with each engineer carrying primary accountability for a specific stage of that cycle. There is no outsourced SOC. The team owns detection, triage, containment, response, engineering, governance, and validation end to end, with AI-driven automation as the 24/7 operational backbone.

The operating philosophy is explicit: humans make decisions, systems enforce. You are not here to watch dashboards. You are here to build the automated controls, integrations, and enforcement mechanisms that make security a property of the platform rather than a layer bolted on top of it.

Why This Role Exists

The fastest path from vulnerability to breach at a SaaS company runs through the software delivery pipeline and the applications it ships. This role closes that path permanently. Not through gates that slow down engineering, but through automated controls embedded so deeply into the development workflow that security becomes a property of delivery. The same engineer also owns application security, API security, and SaaS posture, because the application layer and the pipeline that produces it are a single attack surface.

What You Own

Pipeline Security Gates

• You implement and maintain the full security gate framework across all HRS CI/CD pipelines. All gates are blocking, not advisory.

• You deploy and maintain a secrets scanning tool as a pre-commit hook and pipeline step, blocking any merge that introduces exposed credentials, with automated revocation integration when a secret is detected. (Gitleaks is already in place and in production.)

• You deploy and tune a static analysis platform as the primary SAST tool.

• You develop and maintain custom rules for HRS-specific vulnerability patterns, business logic security issues, and anti-patterns unique to the HRS codebase. Lightweight, developer-friendly, and low false-positive by design.

• You own software composition analysis and SBOM across all codebases, configured to block builds on critical CVEs in production dependencies. The SBOM is maintained in a standard format and updated on every production release.

  Container image scanning is integrated at the registry push stage. Base image standards, maximum age, required patches, and image signing are enforced. (Trivy is already in place and in production.)

  IaC scanning is integrated into all infrastructure deployment pipelines in coordination with the Cloud and Infrastructure engineer.

• You measure pipeline gate coverage as a primary north star metric: 100% of production-impacting pipelines with all gates active and blocking.

Application Security

• You conduct threat modeling sessions for all significant new features, integrations, and architecture changes before engineering begins, using STRIDE or equivalent.

• You maintain a threat model registry covering all active HRS product areas.

• You conduct manual application security assessments, prioritized by risk exposure and recent change activity.

• You operate a web application scanning and DAST platform for continuous application-layer vulnerability coverage. (AppCheck is currently in POC and will be the production tool if it passes evaluation.)

API and Integration Security

• You own API security governance across all partner-facing and internal APIs.

• You assess all new API integrations for authentication, authorization, rate limiting, and data exposure risk before they go live.

• You maintain the API security registry with assessment date, risk rating, and findings.

SaaS Security Posture Management

• You operate an SSPM platform for continuous SaaS misconfiguration detection, shadow SaaS discovery, and OAuth governance.

• You maintain the OAuth application inventory, ensure all third-party OAuth grants are reviewed and scoped to least privilege, and revoke unapproved grants within 48 hours.

• You integrate SSPM findings into the central detection platform for anomalous SaaS access pattern detection.

Security Champions Program

• You design and operate the Security Champions program across all HRS engineering squads globally. You recruit and onboard at least one Security Champion per squad.

• You run monthly Security Champion sessions.

• You produce and maintain a developer-facing secure coding guide for the top vulnerability classes in the HRS tech stack. Champions in Vietnam provide lightweight hub security coverage under your program governance.

The Shared Engineering Foundation

• All four Bangalore security engineers operate on a shared foundation.

• You contribute to multiple stages of the security cycle beyond your primary domain.

• You design for automation first.

• You document every control and configuration within 48 hours of a change. You report north star metrics weekly.

• You contribute to quarterly fire drills, tabletop exercises, and restore tests. You are cross-domain by expectation, not by exception.

What You Bring

Five or more years of security engineering experience with demonstrated hands-on DevSecOps and application security ownership. Proven experience implementing pipeline security controls with genuine blocking enforcement, not advisory-only tooling. Deep static analysis experience including ability to write custom rules for application-specific vulnerability patterns. Application security assessment capability beyond automated scanning: manual penetration testing, API security testing, and threat modeling practice. Experience with SaaS security posture management and OAuth governance at enterprise scale. Demonstrated ability to build developer trust and operate the Security Champions model. Scripting capability in Python or equivalent.

What Strong Looks Like

Within 90 days: all five pipeline security gates are live and blocking across all production-impacting pipelines, with zero deployments bypassing any gate. Within six months: custom static analysis rules covering the top HRS-specific vulnerability patterns are deployed, SSPM is live and the OAuth inventory is current, and AppCheck application scanning is in production. Within twelve months: the Security Champions program has active champions across all engineering squads, threat model coverage extends to all active product areas, and pipeline security evidence is audit-ready.

Who You Are

• You have worked closely enough with engineering teams to understand why developers work around security controls, and you use that understanding to design controls that developers do not want to work around.

• You measure your impact in vulnerabilities that never reached production, not in findings you reported after the fact.