Software Dev Engineer II
Swiggy · Bengaluru · 3–5 yrs experience · Posted 2026-07-19
Tech stack: AWS, Azure, GCP, Go, Python, Machine Learning, Generative AI
Apply on the company site · Get a referral for this role
Swiggy salary & ratings · Swiggy interview process · More live openings
About the role
Official Swiggy role: Software Dev Engineer II.
Official business unit: Technology.
Location: Bangalore, India.
Responsibilities:
- Official Swiggy role: Software Dev Engineer II.
- Official business unit: Technology.
Qualifications:
- Must-Have
- 4+ years in security engineering, with at least 2 years of hands-on penetration testing
- Demonstrated experience with AI/LLM security - prompt injection, model manipulation, or MCP security assessments
- Strong proficiency in web app and API pentesting (OWASP Top 10, business logic flaws, auth bypasses)
- Solid scripting ability in Python, Go, or Bash to build custom tooling
- Experience with cloud security (AWS, GCP, or Azure) - misconfigurations, IAM abuse, lateral movement
- Familiarity with CI/CD security tooling - integrating SAST/DAST/SCA into pipelines
- Experience conducting risk assessments and communicating findings to non-technical stakeholders Good to Have
- Bug bounty track record or CVE publications
- Experience with agentic AI frameworks (LangChain, AutoGPT, Claude Agents) from an attacker's perspective
- Knowledge of compliance frameworks: SOC 2, ISO 27001, PCI-DSS What will you get to do here? Penetration Testing (Primary)
- Lead and execute end-to-end penetration tests across web applications, APIs, internal services, and cloud infrastructure
- Design and run red team exercises simulating real-world adversarial scenarios
- Perform threat modeling on new product features and architectures before they ship
- Develop custom exploits, scripts, and tooling to improve test coverage and repeatability
- Produce clear, actionable pentest reports for both engineering and
- Manage third-party pentest vendors and coordinate responsible disclosure programs AI & LLM Security
- Research and execute attacks against AI/LLM-powered systems - prompt injection, jailbreaks, indirect prompt injection via tool outputs, and data exfiltration through model responses
- Assess security risks in Model Context Protocol (MCP) deployments evaluate tool call boundaries, context poisoning vectors, and privilege escalation through agentic workflows
- Build an internal threat library for AI attack patterns and maintain a red-teaming playbook for LLM features
- Partner with ML and product teams to bake security into the AI feature development lifecycle DevSecOps
- Embed security controls into CI/CD pipelines - SAST, DAST, SCA, secret scanning, and container scanning
- Define and enforce secure coding standards and review gates across teams
- Champion security automation so engineers can move fast without introducing critical vulnerabilities Risk Assessment (Supporting)
- Assess and prioritize security risks across the organization using frameworks such as CVSS, DREAD, or FAIR
- Maintain a live risk register; track remediation progress and report risk
- Evaluate risks introduced by third-party vendors, integrations, and open-source dependencies
- Quantify business impact of vulnerabilities to support data-driven remediation prioritization Compliance & Governance (Supporting)
- Assist in security audits and gap assessments
- Help define and maintain security policies, standards, and exception processes Visit our tech blogs to learn more about some the challenges we deal with https://bytes.swiggy.com/the-swiggy-delivery-challenge-part-one-6a2abb4f82f6 https://bytes.swiggy.com/swiggy-distance-service-9868dcf613f4 https://bytes.swiggy.com/the-tech-that-brings-you-your-food-1a7926229886 sex, disability status, or any other characteristic protected by the law.
Qualifications
- Must-Have 4+ years in security engineering, with at least 2 years of hands-on penetration testing
- Demonstrated experience with AI/LLM security - prompt injection, model manipulation, or MCP security assessments
- Strong proficiency in web app and API pentesting (OWASP Top 10, business logic flaws, auth bypasses)
- Solid scripting ability in Python, Go, or Bash to build custom tooling
- Experience with cloud security (AWS, GCP, or Azure) - misconfigurations, IAM abuse, lateral movement
- Familiarity with CI/CD security tooling - integrating SAST/DAST/SCA into pipelines
- Experience conducting risk assessments and communicating findings to non-technical stakeholders Good to Have
- Bug bounty track record or CVE publications
- Experience with agentic AI frameworks (LangChain, AutoGPT, Claude Agents) from an attacker's perspective
- Knowledge of compliance frameworks: SOC 2, ISO 27001, PCI-DSS What will you get to do here?
- Penetration Testing (Primary)
- Lead and execute end-to-end penetration tests across web applications, APIs, internal services, and cloud infrastructure
- Design and run red team exercises simulating real-world adversarial scenarios
- Perform threat modeling on new product features and architectures before they ship
- Develop custom exploits, scripts, and tooling to improve test coverage and repeatability
- Produce clear, actionable pentest reports for both engineering and Manage third-party pentest vendors and coordinate responsible disclosure programs AI & LLM Security
- Research and execute attacks against AI/LLM-powered systems - prompt injection, jailbreaks, indirect prompt injection via tool outputs, and data exfiltration through model responses
- Assess security risks in Model Context Protocol (MCP) deployments evaluate tool call boundaries, context poisoning vectors, and privilege escalation through agentic workflows
- Build an internal threat library for AI attack patterns and maintain a red-teaming playbook for LLM features
- Partner with ML and product teams to bake security into the AI feature development lifecycle DevSecOps
- Embed security controls into CI/CD pipelines
- SAST, DAST, SCA, secret scanning, and container scanning
- Define and enforce secure coding standards and review gates across teams
- Champion security automation so engineers can move fast without introducing critical vulnerabilities Risk Assessment (Supporting)
- Assess and prioritize security risks across the organization using frameworks such as CVSS, DREAD, or FAIR
- Maintain a live risk register; track remediation progress and report risk
- Evaluate risks introduced by third-party vendors, integrations, and open-source dependencies
- Quantify business impact of vulnerabilities to support data-driven remediation prioritization Compliance & Governance (Supporting)
- Assist in security audits and gap assessments
- Help define and maintain security policies, standards, and exception processes Visit our tech blogs to learn more about some the challenges we deal with https://bytes.swiggy.com/the-swiggy-delivery-challenge-part-one-6a2abb4f82f6 https://bytes.swiggy.com/swiggy-distance-service-9868dcf613f4 https://bytes.swiggy.com/the-tech-that-brings-you-your-food-1a7926229886 sex, disability status, or any other characteristic protected by the law.
Responsibilities
- Official Swiggy role: Software Dev Engineer II.
- Official business unit: Technology.