Security Engineer

What are we trying to solve/mission?:

We are passionate about helping Indians invest better. We manage investments with active oversight to help both sophisticated and new investors build long-term wealth across various market conditions.

What You Will Do:

• Application & Mobile Security: Lead manual and automated penetration testing (SAST/DAST/IAST) across our Web and Mobile applications. Identify business-logic flaws beyond standard automated scanner findings.
• Cloud & Container Security: Harden and audit our AWS cloud infrastructure, Docker containers, and Kubernetes (K8s) clusters. Build real-time posture management (CSPM) and container security controls.
• DevSecOps & Automation: Integrate automated security gates (dependency scanning, secret detection, code analysis) directly into CI/CD pipelines using Python, Go, or Bash.
• Threat Modeling & Shift-Left: Partner directly with Product and Engineering teams during design phases to conduct threat modeling (STRIDE) and establish secure architecture patterns before code is written.
• Vulnerability Management & Incident Response: Own the vulnerability lifecycle-from discovery and triage to remediation tracking. Participate in the security incident response rotation and lead post-incident reviews.
• Regulatory & Compliance Alignment: Work closely with the Lead to ensure our application and cloud controls align with SEBI CSCRF (Cyber Security and Cyber Resilience Framework) guidelines and ISO 27001 standard requirements.
• Security Culture: Conduct targeted security awareness workshops and secure coding sessions for engineering and product teams.

What We Are Looking For:

Required Qualifications:

• 3 to 5 years of hands-on experience in Application Security, Penetration Testing, and Cloud Security.
• Core AppSec Expertise: Deep knowledge of OWASP Top 10 (Web & Mobile), business logic vulnerabilities, API security testing, and hands-on proficiency with tools like Burp Suite Pro, OWASP ZAP, Postman, and MobSF.
• Cloud & Infra Security: Demonstrated experience securing AWS environments and containerized workloads (Docker, Kubernetes/EKS).
• Scripting & Automation: Proficiency in Python, Go, or Bash to automate security workflows, parse tool outputs, or build custom security scripts.
• Threat Modeling: Hands-on experience mapping threat models for complex web/mobile financial architectures.

Nice to Have / Bonus:

• Fintech Experience: Prior experience working in a regulated Fintech or WealthTech environment in India.
• Regulatory Knowledge: Familiarity with SEBI CSCRF, RBI cybersecurity guidelines, or ISO 27001.
• Certifications: Offensive Security certifications like OSCP, or cloud security credentials (AWS Certified Security - Specialty). (Note: Hands-on skills beat certifications).

Skills

AppSec, Application Security, Cloud Security, Penetration Testing, Pentesting