Omnissa
At a Glance
Job Description:
We are Omnissa!
The world is evolving fast, and organizations everywhere—from corporations to schools—are under immense pressure to provide flexible, work-from-anywhere solutions. They need IT infrastructure that empowers employees and customers to access applications from any device, on any cloud, all while maintaining top-tier security. That’s where Omnissa comes in.
The Omnissa Platform is the first AI-driven digital work platform that enables smart, seamless and secure work experiences from anywhere. It uniquely integrates multiple industry-leading solutions including Unified Endpoint Management, Virtual Apps and Desktops, Digital Employee Experience, and Security & Compliance through common data, identity, administration, and automation services. Built on the vision of autonomous workspaces - self configuring, self-healing, and self-securing - Omnissa continuously adapts to the way people work; delivering personalized and engaging employee experiences, while optimizing security, IT operations and costs. we're experiencing rapid growth—and this is just the beginning of our journey!
At Omnissa, we’re driven by a shared mission to maximize value for our customers. Our five Core Values guide us: Act in Alignment, Build Trust, Foster Inclusiveness, Drive Efficiency, and Maximize Customer Value—all with the aim of achieving shared success for our clients and our team.
As a global private company with over 4,000 employees, we’re always looking for passionate, talented individuals to join us. If you're ready to make an impact and help shape the future of work, we’d love to hear from you!
What is the opportunity?
Application Security Engineer plays a critical role in improving the overall security posture of our products and platforms. This role focuses on end-to-end security testing across Web, Mobile, and Thick Client applications, and partners closely with product and engineering teams to implement secure development practices. The candidate will lead initiatives related to threat modelling, secure code reviews, feature assessments, automation (e.g., Semgrep), and root cause analysis for high-impact vulnerabilities.This is an Individual contributor role that requires deep technical expertise, leadership in security initiatives, and a proactive mindset for process improvement.
Must have Skills : -
5 to 8 years of experience in the security domain, specifically in Application/Product Security.
Demonstrated expertise in: Web, Mobile, and Thick Client security testing.
Threat modelling and secure design review.
Manual code reviews across multiple languages and frameworks.
Use and automation of security tools such as Semgrep, SAST/DAST tools, and custom scripts.
Proficiency with languages such as Java, Kotlin, Swift, JavaScript, Python, C#/.NET.
Strong understanding of security principles including authentication, authorization, secure storage, and cryptographic best practices.
Excellent communication skills, including the ability to present security issues and recommendations to technical and non-technical stakeholders.
Good to have skills : -
Hands-on experience with CI/CD security automation, container security, and cloud environments (AWS/GCP/Azure).
Certifications such as OSWE, OSCP, OSEP, GWAPT, GMOB, or equivalent.
Experience working with bug bounty programs, VDPs, or vulnerability triage.
Track record of contributions to the security community (e.g., blogs, talks, open-source tools, CVEs).
Key Responsibilities:-
Security Testing & Reviews
Conduct in-depth manual and automated security testing of Web, Mobile (Android/iOS), and Thick Client applications.
Perform secure code reviews using both manual techniques and tools like Semgrep, integrated into CI/CD pipelines.
Review product features for potential security issues early in the development lifecycle and provide risk-based recommendations.
Security Architecture & Threat Modelling
Facilitate threat modelling and architecture reviews with product and engineering teams.
Provide guidance on secure design patterns, attack surface reduction, and defense-in-depth strategies.
Process & Posture Improvement
Lead and drive initiatives to improve the overall security posture of products and development practices.
Define and implement scalable security controls and development guardrails.
Security Issue & Incident Collaboration
Work with Incident Response and Bug Bounty teams to evaluate researcher-submitted and customer-reported issues.
Conduct variant and root cause analysis for high-severity (P0/P1) bugs and provide long-term remediation guidance.
Stakeholder Management
Collaborate with Product BU leaders and engineering stakeholders to align on security goals and assist in their execution.
Act as a trusted security advisor to cross-functional teams across the organization.
What will you bring to Omnissa?
Work closely with teams to create, update and maintain threat models
Perform secure code reviews and manual application security testing across all our products
Triage and validate externally reported issues against our products
Provide guidance and education to developers
Develop ways to help identify and prevent systematic issues
Location: Bengaluru
Location Type: HYBRID. NO REMOTE. This role offers a balanced arrangement, with the expectation of working 3 days a week in our local office and the flexibility to work from home for the remaining days. It is essential that you reside within a reasonable commuting distance of the office location for the in-office workdays.
Travel Expectations: 5% of travel Domestic/International only if business demands.
What is the leadership like for this role? What is the structure and culture of the team like?
Report to the Manager / Sr. Manager. Work closely with a committed team of security engineers, product managers, and developers focused on innovation and getting things done. Build trust among team members and stakeholders, committing to customer success. Operate in a transparent, communicative environment that emphasizes work-life balance and having fun at work.
Source: Omnissa careers · View original posting
Omnissa is a standalone software company that specializes in an AI-driven digital work platform. Launched in 2024 after being spun off from VMware's End-User Computing business, it is backed by KKR and has a valuation of $4 billion. With 4,000 employees and $1.5 billion in annual recurring revenue, Omnissa serves 26,000 customers globally, including seven of the top ten Fortune 500 companies. The company focuses on unifying, automating, and scaling digital workspaces to enhance IT efficiency and employee empowerment. Its comprehensive platform includes key offerings such as Workspace ONE for unified endpoint management, Horizon for secure virtual desktops and apps, and Digital Employee Experience solutions that streamline onboarding and app access. Omnissa emphasizes security and compliance across all devices and locations, aiming to create an autonomous workspace powered by data and intelligence.
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
Security Philosophy
“Omnissa's AppSec mission is defined by its Security Development Lifecycle (SDL), a set of processes, tools, and practices. The Security Engineering team focuses on building secure products, and their risk philosophy includes threat modeling to identify security flaws and incorrect design assumptions. Long-term goals involve increasing software security awareness through a Security Evangelism team and maintaining a Vulnerability Management program backed by approved policies. Information regarding the reporting line for Product/AppSec is not publicly available.”
Security Team
The Omnissa Product Security group develops and drives software security initiatives across R&D organizations, though a formal reporting chain is not publicly available. Key public-facing leaders include Andrea Smith (Sr. Program Manager, Customer Security Assurance), Morey Straus (Sr. Manager, Product Security), and Andrew Osborn (Staff Technical Marketing Architect). The team size estimate is not publicly available. As of, there is 1 active AppSec job posting. Common skill/tool patterns from job postings include the use and automation of security tools such as Semgrep, utilization of SAST and Software Composition Analysis (SCA), and CI/CD security automation. Public org charts and exact team size are not published.
Key Initiatives
There is no public evidence of an explicit 'Security Champions' program, though the Security Evangelism team's long-term goal is to increase software security awareness. 'Shift Left' practices include SDL planning early in the development lifecycle, threat modeling to identify security flaws, and utilizing SAST and Software Composition Analysis (SCA). The vulnerability management process involves customers reporting security issues to the Product Security group and regular vulnerability scans. The VRT leads the analysis and remediation of security issues, with system and application owners required to address critical and high vulnerabilities; specific SLAs or MTTR numbers are not publicly available. Secure SDLC artifacts include formal Security Reviews before Beta, Release Candidate, and RTM milestones, and penetration testing to circumvent security controls. A recent initiative (last 6 months) involves unifying management and security with AI-driven tools. No public evidence of an explicit 'security champions' program title or published remediation SLA values was found.
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
Interested in this role?
Apply on Omnissa's site