Principal Engineer (security)

About the Role

As a Principal Security Engineer at Sage, you will drive improvements spanning the whole SDLC and post-launch operations. You will work with all engineers to develop a strong security culture and capability to ensure that new product/system releases are secure, and that vulnerabilities discovered are quickly and effectively addressed.

We are looking for someone with a relevant degree and 10+ years' experience.

Location: Bangalore, India. This is a hybrid role, three days per week in the office.

Required Skills- Significant experience in implementing security in the software development lifecycle

• Experience in implementing security in public cloud-based SaaS applications
• OAuth2 / OIDC / JWT validation (RS256, JWKS), token propagation, and multi-issuer auth.
• Secure coding against the OWASP Top 10; multi-tenant isolation and row-level security.
• Proficiency in English, written and verbal
• Experience of working with geographically dispersed teams
• Experience working in an agile, DevOps/DevSecOps environment
• Experience using AI tools to improve security operations, such as AI-assisted code scanning, vulnerability triage, or threat modeling.
• Awareness of AI/ML-specific security and privacy risks (prompt injection, data leakage, model governance) and the ability to fold them into existing secure development lifecycle and compliance practices
• Comfortable partnering with product and engineering teams to assess and mitigate security and privacy risks specific to AI-driven capabilities.
• Experience of formal compliance frameworks (e.g. SOC, ISO27001, PCI or similar)
• Relevant professional security qualifications such as CISSP, CSSLP, AWS Security Specialty or similar.
• Ability to translate technical security risks into clear business implications.
• Experience with security observability, detection engineering, and incident response.

Nice to Have- Hands-on experience with AWS or Azure, Kubernetes, container security, and infrastructure as code.

• Experience securing large-scale fintech applications, payment systems, or financial integrations.
• Experience designing zero-trust access controls, secure API gateways, and identity and access management solutions.
• Participation in web security CTFs or bug bounty programs, particularly those involving fintech, cloud, or infrastructure.

#LI-RT

Key Responsibilities

Responsibilities- Working with all engineers to develop a strong security capability in teams and improving the effectiveness of the overall Security Champion program

• Driving continual improvement in the secure software development lifecycle and supporting our drive to a modern DevSecOps approach
• Acts as the main point of contact on security issues for Product Delivery teams on major strategic groups of products/systems
• Assessing the application to identify security weaknesses and creating improvement plans where required
• Supporting security compliance as it relates to assigned product
• Identifies the need for new tools and vendors and leads their evaluation
• Drives significant improvement in key processes/standards and designs and implements new processes/standards
• Contributes to performance evaluation and technical mentoring of junior team members
• Provides technical security leadership for significant projects or workstreams
• Active contributor to relevant industry bodies, conferences, open-source projects etc.

#LI-RT