Role Overview:

We are looking for a skilled and driven Senior Security Engineer to join our growing security team. This role requires a hands-on professional who can evaluate and strengthen the security posture of our applications and infrastructure across Web, Android, iOS, APIs, and cloud-native environments. The ideal candidate will also lead technical triage from our bug bounty program, integrate security into the DevOps lifecycle, and contribute to building a security-first engineering culture.

Key Responsibilities:

• Perform Security reviews, Vulnerability Assessments & Penetration Testing for Web, Android, iOS, and API endpoints

• Perform Threat Modelling & anticipate potential attack vectors and improve security architecture on complex or cross-functional components

• Identify and remediate OWASP Top 10 and mobile-specific vulnerabilities

• Conduct secure code reviews and red team assessments

• Integrate SAST, DAST, SCA, and secret scanning tools into CI/CD pipelines

• Automate security checks using tools like SonarQube, Snyk, Trivy, etc.

• Maintain and manage vulnerability scanning infrastructure

• Perform security assessments of AWS, Azure, and GCP environments, with an emphasis on container security, particularly for Docker and Kubernetes.

• Implement guardrails for IAM, network segmentation, encryption, and cloud monitoring

• Contribute to infrastructure hardening for containers, Kubernetes, and virtual machines

• Triage bug bounty reports and coordinate remediation with engineering teams

• Act as the primary responder for external security disclosures

• Maintain documentation and metrics related to bug bounty and penetration testing activities

• Collaborate with developers and architects to ensure secure design decisions

• Lead security design reviews for new features and products

• Provide actionable risk assessments and mitigation plans to stakeholders

Required Skills & Experience:

• 5 to 8 years of solid hands-on experience in the VAPT domain

• Solid understanding of Web, Android, and iOS application security

• Experience with DevSecOps tools and integrating security into CI/CD

• Strong knowledge of cloud platforms (AWS/GCP/Azure) and their security models

• Familiarity with bug bounty programs and responsible disclosure practices

• Familiarity with tools like Burp Suite, MobSF, OWASP ZAP, Terraform, Checkov..etc

• Good knowledge of API security

• Scripting experience (Python, Bash, or similar) for automation tasks

Preferred Qualifications:

• OSCP, CEH, AWS Security Specialty, or similar certifications

• Experience working in a regulated environment (e.g., FinTech, InsurTech)