About the Role

Zoho is seeking talented and passionate Application Security Engineers to join our security team in Chennai. This role is ideal for candidates with 0–2 years of experience in Security Operations or Application Security who are eager to grow their expertise in safeguarding applications, services, and infrastructure.

Key Responsibilities

• Conduct comprehensive risk assessments to identify, document, and prioritize technical risks, translating vulnerabilities into actionable business insights.
• Perform threat modeling for applications, services, and infrastructure, identifying attack vectors and security gaps using frameworks such as STRIDE.
• Lead threat modeling sessions with engineering teams for new features and projects.
• Oversee the full lifecycle of vulnerabilities in software and infrastructure, from detection to remediation.
• Implement and fine-tune SAST, DAST, and IAST tools to maintain high-quality security signals without impeding development workflows.
• Conduct manual code reviews to detect critical business logic vulnerabilities that automated tools may miss.
• Monitor, triage, and investigate security alerts from intrusion detection systems, SIEMs, and other monitoring tools.
• Develop automation scripts in Python, Bash, or similar languages to streamline alert handling and incident response processes.
• Analyze suspicious activity, validate incidents, and support incident response and post-incident analysis.
• Collaborate with development teams to remediate vulnerabilities and integrate security checks into CI/CD pipelines.
• Maintain clear documentation of findings, remediation actions, and security recommendations.

Required Skills

• Strong knowledge of network protocols, Linux internals, and the MITRE ATT&CK framework.
• Experience with threat modeling methodologies such as STRIDE or attack trees.
• Hands-on experience with SAST, DAST, and IAST tools.
• Proficiency in AppSec tools like Snyk, Veracode, Checkmarx, Burp Suite, OWASP ZAP, or Contrast Security.
• Programming skills in at least one major language for building security tools and automation.
• Familiarity with AWS, Azure, or GCP security services.
• Experience with Infrastructure as Code, log analysis, alert tuning, and incident response is a plus.

Location

Chennai, Tamil Nadu, India

Experience

0–2 years