Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 11 hours ago

Application Security Engineer

OakNorth30 open roles

Where
Gurugram
Work mode
Hybrid
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowApplication Security EngineerOakNorth · Gurugram

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on OakNorth's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. OakNorth postings stay open a median of 20 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 58.1%60 days
This job: posted 11 hours ago

OakNorth median: 20 days open

The posting

ABOUT US

At OakNorth, we're on a mission to empower ambitious businesses and the communities they serve. Since 2015, we've lent over $21 billion across the UK and US, helped create more than 58,000 new homes and 36,000 new jobs, and supported hundreds of thousands of personal savers — all while driving economic growth in the markets we serve.

ABOUT THE ROLE

The Application Security Engineer is a hands-on, full-stack security role focused on fixing the hardest application and AI security problems — particularly those that cross team boundaries or involve architecture, authentication, and authorisation that automation cannot yet safely resolve. You'll take remediation load away from engineering teams so they can stay focused on delivery, working closely with the teams that detect, prioritise, and track vulnerabilities. You'll also contribute to the development of OakNorth's internal coding agent platforms, so security fixes can scale safely.

WHAT YOU'LL DO

- Fix complex application security vulnerabilities directly, including architectural weaknesses and issues in legacy technology that automated remediation cannot yet handle safely.

- Lead remediation of problems that cross team and system boundaries, coordinating changes across multiple owners and services and seeing them through to resolution.

- Resolve authentication and authorisation weaknesses, including identity, access control, session and token handling, service-to-service trust and permission models.

- Act as a dedicated delivery vehicle for security remediation, reducing the fix burden on engineering teams so they can focus on product delivery.

- Interpret the output of security tooling (e.g., SAST, DAST, SCA, secrets, container and IaC scanning), validate findings, identify root causes and implement the right fix rather than only triaging.

- Secure agentic and AI-enabled systems, assessing and mitigating risks such as those in the OWASP Top 10 for Agentic Applications, including prompt injection, excessive agent permissions, tool misuse, insecure agent-to-agent communication and unsafe handling of agent outputs.

- Contribute to the development of our internal coding agent platforms, including remediation agents, by supplying specialist fixes, remediation patterns, evaluation cases and feedback on where agents succeed or fail.

- Define and build guardrails for agent-generated and human-written changes (e.g., least-privilege agent access, human approval points, secure defaults, shared libraries, pipeline checks and policy-as-code) so that changes are safe and vulnerabilities do not recur.

- Build and secure GitHub workflows and release pipelines, including GitHub Actions hardening, secrets and token handling, branch protection, dependency and supply chain controls, and security gates in CI/CD.

- Plan and deliver higher-risk changes safely, including testing, peer review, rollout and rollback approaches, in partnership with the teams that own the systems.

- Work with the teams that detect, prioritise and track vulnerabilities to take prioritised findings through to remediation, and identify recurring fix types that can be automated safely.

- Document remediation approaches, share knowledge and coach engineers on secure design, secure coding and the safe use of AI coding agents.

- Report on remediation progress, including backlog reduction, SLA performance and risk reduction, and provide evidence to support audit and regulatory requirements.

YOU'LL BE A GREAT FIT IF YOU HAVE…

Engineering Skills

- Full stack engineering experience across front end, back end and APIs, with proficiency in one or more languages (e.g., Java, Python, C#, JavaScript/TypeScript) and the ability to work in unfamiliar and legacy codebases.

- Strong hands-on experience with GitHub (pull requests, code review, branch protection, code scanning) and GitHub Actions, including building and securing release pipelines.

- Working knowledge of cloud platforms, containers and infrastructure as code.

- Ability to review code, find vulnerabilities and implement practical, correct fixes.

Application Security Skills

- Strong application security knowledge, including the OWASP Top 10 and common vulnerability classes such as injection, broken access control, insecure deserialization and cryptographic weaknesses.

- Deep understanding of authentication and authorisation, including OAuth 2.0, OIDC, SAML, JWT and session handling, RBAC/ABAC models and service-to-service identity.

- Hands-on experience interpreting application security tooling output (SAST, DAST, SCA, secrets, container and IaC scanning), distinguishing true and false positives and finding root cause.

- Understanding of CI/CD and software supply chain security, including GitHub Actions risks such as untrusted input, over-privileged tokens and third-party action pinning.

AI & Agentic Security Skills

- Day-to-day experience using coding agents such as Claude to write, review and fix code, with sound judgement on where they are reliable and where they are not.

- Knowledge of and informed opinions on the OWASP Top 10 for Agentic Applications and related AI security risks, including prompt injection, tool and permission abuse, data leakage and agent identity.

- Ability to design guardrails, permission boundaries and evaluation approaches for AI agents and agent-generated changes.

- Ability to turn manual fixes into repeatable patterns and test cases that agent platforms can use.

Remediation & Architecture Skills

- Experience fixing architectural and design-level security issues, and making safe changes in systems with limited tests, documentation or clear ownership.

- Ability to plan and deliver changes that span multiple teams and services, managing dependencies and risk.

- Sound judgement on testing, rollout and rollback for higher-risk changes.

Collaboration & Communication Skills

- Ability to work as a trusted partner to engineering teams, explaining why a fix is needed and making it easy to adopt.

- Influence without direct authority across teams that own the affected systems, including stakeholders in different locations and time zones.

- Clear written and verbal communication, including documentation and progress reporting.

Mindset & Attributes

- Ownership and a bias to action: comfortable taking on ambiguous, hard problems and seeing them through to resolution.

- Pragmatic, risk-aware judgement when balancing speed of remediation against the risk of change.

- Curiosity and continuous learning as threats and agentic technologies evolve.

WHAT WE OFFER

- Health & Protection: Medical cover for you, your family & parents; life and accidental cover at a multiple of your salary

- Wellbeing: Annual health check-ups, online doctor consultations, pharmacy discounts, nutritionist support, and an Employee Assistance Programme — all sponsored

- Time Off: Earned, casual/sick leave, public holidays, maternity & paternity leave

- Life Milestones: A financial gesture of support at marriage, childbirth, and bereavement

- Flexible Benefits: Tax-efficient allowances for internet, fuel, meals, leave & travel, and NPS

- Growth: Professional certification support, learning & development opportunities, childcare benefits, and paid volunteering days

- Our Workplace: Modern central offices, weekly business updates, team events, and great coffee — we work hard to build a culture worth showing up for

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against OakNorth's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on OakNorth's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    OakNorth's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.