Commvault
About this role
Commvault is a cyber resilience company listed on NASDAQ, with more than 100,000 organisations using its data protection platform. This role is application security automation: building and maintaining the tooling and pipelines that run static analysis, dynamic analysis and software composition analysis, then wiring them into CI and CD so security checks happen as code moves rather than at the end. The posting also asks you to advise other engineers on secure coding and secure development lifecycle practice, so part of the job is raising the standard around you rather than only running scanners. Named tools include OWASP ZAP for dynamic analysis and Snyk or WhiteSource for composition analysis, with Jenkins, GitHub Actions or GitLab CI as the pipeline layer. Apply if you have 6 or more years of software engineering with a security focus and prefer building guardrails to filing findings.
Who this is for
Requirements as published:
- 6+ years of software engineering experience with a focus on security.
- Ability to design, build, implement and maintain scalable automation tools and pipelines for application security, covering static (SAST), dynamic (DAST) and software composition analysis (SCA) scanning.
- Familiarity with tooling such as OWASP ZAP, Snyk and WhiteSource.
- Familiarity with CI/CD pipelines such as Jenkins, GitHub Actions and GitLab CI, and with infrastructure as code.
- Ability to advise other engineers on secure coding and secure development lifecycle practice.
The actual day to day:
- Building and maintaining the application security automation estate.
- Working with developers, security engineers and DevOps teams to fold security automation into CI and CD workflows rather than bolting it on.
- Finding opportunities to automate work that is currently manual.
- Coaching engineers on secure coding practice.
Location and office reality:
- Bangalore. The posting metadata states Remote Position: No, so treat this as an onsite or hybrid role and confirm the days.
Honest fit guidance:
- This is an engineering role that happens to be in security, not an analyst role. The requirement is 6 years of software engineering, and you will be judged on the code you write.
- If your appsec experience is running scans and triaging output, the automation and pipeline building here is a step up rather than a sideways move.
- Commvault includes a recruitment fraud warning in its postings: it says it does not conduct interviews by email or text and will never ask for banking details or identification documents before your first day. Worth knowing given how common job scams are in this market.
- 6+ years of software engineering experience with a focus on security.
- Ability to design, build, implement and maintain scalable automation tools and pipelines for application security, covering static (SAST), dynamic (DAST) and software composition analysis (SCA) scanning.
- Familiarity with tooling such as OWASP ZAP, Snyk and WhiteSource.
- Familiarity with CI/CD pipelines such as Jenkins, GitHub Actions and GitLab CI, and with infrastructure as code.
- Ability to advise other engineers on secure coding and secure development lifecycle practice.
The actual day to day:
- Building and maintaining the application security automation estate.
- Working with developers, security engineers and DevOps teams to fold security automation into CI and CD workflows rather than bolting it on.
- Finding opportunities to automate work that is currently manual.
- Coaching engineers on secure coding practice.
Location and office reality:
- Bangalore. The posting metadata states Remote Position: No, so treat this as an onsite or hybrid role and confirm the days.
Honest fit guidance:
- This is an engineering role that happens to be in security, not an analyst role. The requirement is 6 years of software engineering, and you will be judged on the code you write.
- If your appsec experience is running scans and triaging output, the automation and pipeline building here is a step up rather than a sideways move.
- Commvault includes a recruitment fraud warning in its postings: it says it does not conduct interviews by email or text and will never ask for banking details or identification documents before your first day. Worth knowing given how common job scams are in this market.
Apply on company site
Opens job-boards.greenhouse.io, the employer's own application page. Applying is always free.