Senior Staff Engineer, Product Security
Pune, Maharashtra · 6-10 years experience · Posted Oct 1, 2026
At a glance
- Experience
- 6-10 years experience
- Location
- Pune, Maharashtra
About Druva
- Druva is the resilience foundation for the AI enterprise, helping organizations secure and recover from connected risk across data, cyber, identity, and AI. The Resilience Cloud is a fully managed, cloud-native SaaS platform that delivers air-gapped and immutable protection across cloud, SaaS, on-premises, endpoint, and edge environments. Powered by Dru MetaGraph, Druva’s graph-powered intelligence layer, the platform connects critical business context so customers can understand risk, respond faster, recover cleanly, and govern data with greater confidence.
- Trusted by nearly 7,500 customers, including 75 of the Fortune 500, Druva helps safeguard the critical information and systems businesses depend on in an increasingly connected world.
- Visit druva.com and follow us on LinkedIn, X and Facebook.
- Experience Level: 6–10 Years
- Domain: Product Security / AppSec / DevSecOps / AI Security / AI-First SDLC
About the role
- The Senior Staff Product Security Engineer will lead initiatives to architect an AI-first SDLC and integrate traditional AppSec with advanced AI security practices.
- This role involves partnering with engineering, GRC, and DevOps teams to secure SaaS products and enable agentic features.
- The position focuses on automating shift-left pipelines, conducting threat models for complex AI architectures, and leveraging AI tools for vulnerability remediation.
Responsibilities
- Architect and embed AI-driven security controls into CI/CD build pipelines and developer workflows.
- Strategize security controls for product-facing AI features and leverage AI tooling for auto-triage and threat-model drafting.
- Assess risks specific to Generative and Agentic AI architectures, including MCP integrations and autonomous agents.
- Review code and partner with engineering to implement robust security fixes.
- Manage third-party open-source risks, dependency tracking, and Software Bills of Materials (SBOMs).
- Conduct secure coding workshops and train developers on secure AI usage.
- Grow and maintain an active Security Champions network.
Requirements
- 6–10 years of product security engineering experience in a SaaS environment.
- Proven track record of technical leadership.
- Deep expertise in OWASP Top 10, CWE 25, threat modeling, cryptography, container security, and secure SDLC frameworks.
- Hands-on expertise with AI-first SDLC methodologies and reviewing AI security risks for Agentic AI systems and LLM security controls.
- Experience using AI tools to optimize security engineering workflows.
- Proficiency in code review and scripting with Python, Go, or Javascript.
- Bachelor’s degree in CS/IT or equivalent.
Preferred qualifications
- Hands-on development experience
- Relevant certifications such as OSCP, OSWE, CSSLP, or GIAC
- Active community contributions to organizations like OWASP, BSides, NullCon, or Black Hat
Skills
- Python
- Go
- JavaScript
- SAST
- DAST
- SCA
- Burp Suite
- Snyk
- OWASP ZAP
- CI/CD
- LLM Security
