Senior Application Security Engineer

Senior Application Security Engineer

Location

Bangalore, IN, 562122

Position Type:

Professional

Permanent/Temporary:

Permanent

Transport is at the core of modern society. Imagine using your expertise to shape sustainable transport and infrastructure solutions for the future. If you seek to make a difference on a global scale, working with next-gen technologies and the sharpest collaborative teams, then we could be a perfect match.

Role Purpose

The Application Security Engineer is responsible for building, evolving, and scaling the organization’s third-party and software supply chain security capabilities across Volvo Group.

This role contributes directly to the development of governance models, operating frameworks, risk methodologies, and enablement structures that allow Stable Teams to securely consume third-party software, SaaS services, APIs, open-source components, and external technology providers.

The focus of the role is capability building: designing how supply chain and third-party security is governed, understood, and adopted across the organization, and enabling its execution through guidance, education, and scalable frameworks.

Mission

Develop and mature enterprise-wide capabilities for third-party and supply chain security by translating governance and risk objectives into scalable frameworks, practical guidance, and structured enablement models.

Enable Stable Teams to make informed, risk-based decisions when consuming external software and services, while continuously improving the organization’s ability to govern, assess, and manage third-party and supply chain risks.

Key Accountabilities Capability Building – Third-Party & Supply Chain Security Governance

• Contribute to the design, development, and evolution of third-party and supply chain security governance capabilities.
• Help define scalable operating models, frameworks, and standards for managing external software and supplier risk.
• Develop and refine tiered risk models and governance structures for third-party and supply chain security.
• Ensure governance capabilities are practical, adoptable, and aligned with how Stable Teams consume external technology.

Capability Enablement for Stable Teams

• Build enablement structures that allow Stable Teams to understand and apply third-party and supply chain security requirements.
• Develop playbooks, and decision frameworks for managing external software and vendor risk.
• Design and deliver workshops and enablement programs that build organizational capability in supply chain security.
• Enable teams to make consistent, risk-informed decisions when adopting third-party software and services.

Security Maturity & Capability Progression

• Design and evolve maturity models specifically for third-party and supply chain security capabilities.
• Define what “good” looks like across different maturity levels in managing external dependencies and supplier risk.
• Develop structured maturity assessment approaches and capability roadmaps.
• Identify gaps in organizational capability and define initiatives to close them at scale.
• Support progression from ad-hoc third-party risk handling to structured, repeatable governance capabilities.

Metrics, Insights & Capability Measurement

• Define metrics that measure maturity and effectiveness of third-party and supply chain security capabilities.
• Develop indicators for capability adoption, governance effectiveness, and risk reduction across external dependencies.
• Analyze trends to identify where capability gaps exist and where governance improvements are needed.
• Provide insights that guide the evolution of supply chain security capabilities over time.

Ecosystem Capability Integration

• Collaborate with application security team to embed supply chain security capabilities into tooling, automation, and workflows.
• Contribute to defining scalable patterns for secure consumption of third-party components within delivery pipelines.
• Support the evolution of “Golden Path” for safe and standardized use of external software and services.

Advisory & Influence

• Provide expert input into third-party and supply chain security decisions across DV/BA/GF.
• Influence adoption of governance models and security practices through guidance and early engagement.
• Translate complex supply chain risk concepts into understandable and actionable guidance for Stable Teams.
• Stay current on emerging supply chain threats and ensure they are reflected in capability evolution.

Expected Outcomes

Capability Development Ownership

• Owns and contributes to the development of enterprise capabilities for third-party and supply chain security.
• Supports the evolution of governance models, operating structures, and maturity frameworks.
• Ensure capabilities are scalable, reusable, and aligned with organizational technology consumption patterns.
• Identifies opportunities to improve or introduce new capabilities in response to emerging risks and business needs.

Stakeholder Engagement

• Works closely with Stable Teams, Digital Product Owners (DPOs), Procurement, Vendor Management, Architecture, and Security Governance stakeholders.
• Acts as a bridge between governance design and real-world adoption of third-party security capabilities.
• Build strong relationships to ensure capability adoption and long-term sustainability.

Security Domains

• Responsible for capability development and enablement across:
• Third-Party Risk Management Capability
• Software Supply Chain Security Capability
• Vendor & SaaS Security Governance
• External API & Integration Security
• Open Source & Dependency Risk Management
• Security Maturity Frameworks (Third-Party Focus)
• Security Governance Operating Models
• Security Enablement & Education Systems
• Risk Metrics & Capability Measurement

Who we are and what we believe in

We are committed to shaping the future landscape of efficient, safe, and sustainable transport solutions. Fulfilling our mission creates countless career opportunities for talents across the group’s leading brands and entities.