Engineering Manager - Senior Security Manager

Job Profile: Senior Security Manager (Engineering Manager)

Location: Bangalore | Karnataka

Years of Experience: 8–10

 

About the Team & Role

Swiggy’s Security Engineering organization sits at the intersection of platform security, application security, API security, vulnerability management, data protection, and security operations. The team is expected to go beyond reactive ticket handling and build durable security controls into how products, platforms, APIs, developer workflows, and partner integrations are designed and operated.

As a Senior Security Manager, you will lead a team responsible for raising Swiggy’s security bar across application and API security, vulnerability prevention, PII protection, security signoffs, secure partner integrations, and operational response. This is not a generic IT security role. It requires a leader who can combine engineering depth, program judgment, and strong execution to turn recurring security issues into systematic controls.

You will operate across multiple modes: driving day-to-day security reviews and escalations, improving the quality and coverage of internal testing, shaping secure implementation decisions for engineering teams, and building automation that prevents classes of vulnerabilities from re-entering production.

 

What will you get to do here?

• Driving application and API security programs, including security testing coverage, release sign-offs, and stronger production-readiness gates for public and sensitive APIs.
• Improving vulnerability management by moving from manual review toward automated detection, alerting, and PR-blocking for known vulnerable packages and risky changes.
• Strengthening PII and sensitive-data protection in internal systems and third-party integrations, including encryption requirements and secure data-sharing patterns.
• Building better security tooling and evaluation frameworks for API security, package risk detection, and infrastructure/application visibility with low operational overhead.
• Leading incident and vulnerability response for P0/P1 security issues, including war-room coordination, stakeholder communication, and closure discipline.
• Improving the quality of internal security validation so external VAPTs and audits become a backstop, not the first place critical issues are discovered.
• Partnering with platform and product engineering teams on controls across authentication, authorization, API abuse prevention, endpoint protection, SIEM inputs, and secure software delivery workflows.
• Managing and mentoring security engineers, setting operating rhythm, and ensuring the team scales through clarity, ownership, and repeatable execution.
• Own the execution and evolution of Swiggy’s application, API, and platform security programs.
• Build a high-trust operating model for security reviews, sign-offs, escalations, and vulnerability communication.
• Ensure critical vulnerabilities are tracked with clear severity, explicit tested scope, accountable owners, and closure criteria.
• Drive security controls into the SDLC through automation such as PR checks, policy gates, repo/package monitoring, and reusable detection workflows.
• Define secure patterns for data handling, especially where customer PII, partner integrations, or sensitive APIs are involved.
• Partner with engineering leaders to prioritize high-risk gaps and convert ad hoc findings into platform controls and team-wide standards.
• Lead vendor/tool evaluations pragmatically, with clear success criteria around detection quality, operational effort, performance impact, and cost.
• Manage, mentor, and grow a security engineering team with strong standards for ownership, technical quality, and execution excellence.

What Qualities are we looking for?

• Strong hands-on depth in application security, API security, and secure architecture review.
• Good judgment on authentication, authorization, data protection, secret handling, vulnerability remediation, and secure partner integrations.
• Experience leading security engineers and operating across incident response, stakeholder management, and cross-functional execution.
• Ability to distinguish between a one-off fix and a durable control that prevents repeat issues.
• Comfort working closely with platform, infrastructure, developer tooling, and product engineering teams.
• Strong written and verbal communication, especially during escalations, reviews, and security program discussions.
• Practical orientation toward automation, policy enforcement, and measurable risk reduction rather than checklist-driven security.
• Experience with API security tooling, pen testing workflows, or internal application security programs.
• Experience integrating security controls into CI/CD, repo workflows, package governance, or developer tooling.
• Familiarity with cloud/infrastructure security, endpoint controls, SIEM/SOAR patterns, or security visibility tooling.
• Experience operating in high-scale product and platform environments with multiple engineering teams and fast release cycles.

Visit our tech blogs to learn more about some of the challenging problem statements Swiggy works on:

• https://bytes.swiggy.com/engineering-challenges-at-swiggy-430dea6c86a3
• https://bytes.swiggy.com/the-swiggy-delivery-challenge-part-one-6a2abb4f82f6
• https://bytes.swiggy.com/what-serviceability-means-at-swiggy-c94c1aad352a
• https://bytes.swiggy.com/architecture-and-design-principles-behind-the-swiggys-delivery-partners-app-4db1d87a048a
• https://bytes.swiggy.com/swiggy-distance-service-9868dcf613f4
• https://bytes.swiggy.com/the-tech-that-brings-you-your-food-1a7926229886

 

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, colour, religion, sex, disability status, or any other characteristic protected by law.