Lead Information Security Engineer

About the Role

Synamedia is seeking an experienced Application Security Engineer to enhance the safety of its products and strengthen the software development lifecycle. This position collaborates closely with engineering, architecture, DevOps, cloud, and security teams to detect risks early, automate security protocols, and enable the creation of secure products at scale. The candidate should possess practical application security skills combined with strong software engineering insight and be able to convert security issues into effective remediation strategies.

Key Responsibilities

• Evaluate security of web applications, APIs, microservices, and cloud-native software.
• Lead threat modeling and conduct security design reviews for new developments, features, and architectural modifications.
• Perform secure code analysis to find vulnerabilities, unsafe coding practices, and design flaws.
• Deploy and enhance SAST, DAST, SCA, secrets scanning, and other application security tools.
• Automate security validations and establish risk-based quality gates within CI/CD pipelines.
• Assess, prioritize, and validate vulnerabilities by exploitation potential, technical impact, and business risk.
• Guide engineering teams with actionable remediation insights and oversee the vulnerability resolution process.
• Review systems of authentication, authorization, session management, cryptography, data protection, and input validation.
• Conduct security tests on REST APIs and service interfaces for authorization, injection, data leaks, and business-logic vulnerabilities.
• Create security automation scripts to enhance the scalability and impact of the application security program.
• Develop secure coding guidelines, security checklists, and educational materials for developers.
• Contribute to security metrics, reporting, and continuous improvement of the Secure Software Development Lifecycle (SDLC).

Required Skills and Experience

• Minimum of 7 years in Application Security, Product Security, DevSecOps, penetration testing, or secure software development.
• In-depth knowledge of OWASP Top 10, OWASP API Security Top 10, CWE vulnerability classifications, and secure coding methodologies.
• Proficient with SAST, DAST, Software Composition Analysis (SCA), secrets detection, and web/API testing tools such as Burp Suite or OWASP ZAP.
• Experienced in threat modeling techniques such as STRIDE or similar methodologies.
• Ability to conduct security-focused source code review in languages including Java, C/C++, C#, Python, JavaScript/TypeScript, or Go.
• Familiar with CI/CD tools like Jenkins and GitHub Actions and Git workflows.
• Strong communication skills to clearly present vulnerability impacts, exploit scenarios, remediation strategies, and risks to stakeholders.
• Experience with cloud services (AWS, Azure, GCP), container technologies (Docker, Kubernetes), and Infrastructure-as-Code security.
• Hands-on knowledge of tools like Black Duck, Coverity, Trivy, and TruffleHog.
• Understanding of identity and security standards like OAuth 2.0, OpenID Connect, SAML, JWT, RBAC.
• Insight into software supply-chain security, SBOM, dependency control, and secret management.
• Security certifications (e.g., CSSLP, CISSP, CCSP) are beneficial but not compulsory.

Desirable Domain Knowledge in Video & Media

• Experience or understanding of video streaming, broadcast, OTT, Pay-TV, or media technology sectors.
• Familiarity with platforms like Synamedia Go, Iris, Conditional Access, DRM, and video/content security solutions.
• Knowledge of Conditional Access systems, DRM, entitlement management, content protection, anti-piracy techniques, and secure video delivery mechanisms.
• Understanding of OTT/video protocols such as HLS, MPEG-DASH, CDNs, streaming APIs, video players, and Server-Side Ad Insertion (SSAI).
• Insight into application security risks related to addressable advertising and video monetization involving APIs, customer data, ad-tech integrations, identity controls, and cloud services.
• Experience securing cloud-native SaaS video platforms, microservices, APIs, containers, and distributed architectures.

Desired Knowledge in AI & AI-Assisted Development

• Awareness of AI-assisted coding tools and secure integration of Generative AI in development workflows.
• Understanding security risks linked to AI-generated code including insecure coding patterns, vulnerable dependencies, secret leaks, licensing issues, and insufficient validations.
• Capability to establish secure development standards for teams using AI programming assistants and Generative AI frameworks.
• Experience evaluating applications integrating large language models, AI agents, or generative AI capabilities is a plus.
• Knowledge of AI-specific security threats such as prompt injection, data disclosure, insecure content handling, excessive permissions, model/API misuse, and third-party AI supply-chain vulnerabilities.
• Ability to assist in threat modeling and security analysis of AI-enabled features and services.
• Familiarity with OWASP security guidance for large language models and generative AI applications.
• Interest in leveraging AI and automation to enhance vulnerability validation, secure code auditing, threat modeling, remediation support, and security testing.

Eligibility

Applicants should possess a Bachelor's degree in Engineering or Technology in any discipline.