Job description
About the Role
As a Principal Security Engineer at Sage, you will drive improvements spanning the whole SDLC and post-launch operations. You will work with all engineers to develop a strong security culture and capability to ensure that new product/system releases are secure, and that vulnerabilities discovered are quickly and effectively addressed.
We are looking for someone with a relevant degree and 10+ years' experience.
Location: Bangalore, India. This is a hybrid role, three days per week in the office.
Required Skills
- Significant experience in implementing security in the software development lifecycle
- Experience in implementing security in public cloud-based SaaS applications
- OAuth2 / OIDC / JWT validation (RS256, JWKS), token propagation, and multi-issuer auth.
- Secure coding against the OWASP Top 10; multi-tenant isolation and row-level security.
- Proficiency in English, written and verbal
- Experience of working with geographically dispersed teams
- Experience working in an agile, DevOps/DevSecOps environment
- Experience using AI tools to improve security operations, such as AI-assisted code scanning, vulnerability triage, or threat modeling.
- Awareness of AI/ML-specific security and privacy risks (prompt injection, data leakage, model governance) and the ability to fold them into existing secure development lifecycle and compliance practices
- Comfortable partnering with product and engineering teams to assess and mitigate security and privacy risks specific to AI-driven capabilities.
- Experience of formal compliance frameworks (e.g. SOC, ISO27001, PCI or similar)
- Relevant professional security qualifications such as CISSP, CSSLP, AWS Security Specialty or similar.
- Ability to translate technical security risks into clear business implications.
- Experience with security observability, detection engineering, and incident response.
Nice to Have
- Hands-on experience with AWS or Azure, Kubernetes, container security, and infrastructure as code.
- Experience securing large-scale fintech applications, payment systems, or financial integrations.
- Experience designing zero-trust access controls, secure API gateways, and identity and access management solutions.
- Participation in web security CTFs or bug bounty programs, particularly those involving fintech, cloud, or infrastructure.
#LI-RT