Security Engineer at DNEG, Mumbai

Security Engineer at DNEG in Mumbai. Apply with swipeandhired.

Overview DNEG is seeking a security professional to assess applications, cloud services, AI use cases, and third-party tools before and during their use across the company. The role combines practical security architecture reviews with hands-on evaluation of security solutions. The successful candidate will document risks, recommend workable controls, and support informed approval decisions. Mandatory Requirements and Expectations  Own defined security reviews independently and escalate material risks or complex decisions to senior security stakeholders.  Provide clear, evidence-based recommendations that account for security risk, business use, and implementation effort.  Work closely with engineering, cloud, product, and other internal teams to understand designs and agree on practical actions.  Maintain accurate review records, decisions, conditions, and follow-up actions for the security approval process.  Communicate findings constructively to both technical and non-technical stakeholders. Duties and Operational Responsibilities  Review application and API designs for authentication, authorization, data protection, secure integration, and common attack paths.  Perform threat modelling for new systems and significant changes, and recommend controls that can be implemented and verified.  Assess cloud architectures and configurations, including identity, network exposure, secrets, encryption, logging, and workload security.  Review proposed AI applications and services for data exposure, access control, unsafe outputs, prompt injection, and third-party dependencies.  Evaluate third-party tools before company use by reviewing their security posture, data flows, permissions, integrations, and relevant assurance evidence.  Plan and run proof of concepts for application, cloud, and AI security tools using agreed evaluation criteria; document effectiveness, integration needs, and limitations.  Prepare concise risk assessments and recommendations, including proposed conditions or remediation needed before approval.  Track findings with system and service owners, validate remediation evidence, and identify unresolved risks for escalation.  Contribute to security standards, review checklists, and reusable design guidance to improve consistency across assessments. Mandatory Job Requirements A successful candidate should demonstrate the following experience and capabilities:  Approximately five years of relevant experience in application security, cloud security, security engineering, or security architecture.  Experience reviewing application designs and applying secure development practices, threat modelling, and risk-based remediation.  Working knowledge of application and API security testing, including code, dependency, and dynamic testing approaches.  Hands-on understanding of security controls in at least one major cloud platform, particularly identity, networking, data protection, and monitoring.  Ability to evaluate unfamiliar technologies through proof of concepts, define success criteria, and present a balanced recommendation.  Experience assessing third-party products or services, including how they access, process, store, and share company or client data.  Working knowledge of security risks in AI-enabled applications and the controls used to address them.  Strong written communication and the ability to work with engineers and stakeholders to resolve identified risks. Desirable Experience  Direct experience assessing generative AI applications, including retrieval-based systems or applications that use external tools.  Experience with security assurance reports, vendor questionnaires, and recognized security frameworks such as ISO 27001, NIST, CIS, or OWASP guidance.  Experience evaluating or operating application security, cloud security, or AI security tooling. Education  A bachelor's degree in computer science, information technology, cybersecurity, or equivalent practical experience is desirable.  Relevant security or cloud certifications are desirable but are not a substitute for demonstrated practical experience.