{"id":1251979,"url":"https://alion.io/job/snaphyr-security-engineer","title":"Security Engineer","company":{"id":3806601,"name":"SnapHyr","domain":"snaphyr.com","url":"https://alion.io/company/snaphyr","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":15000,"max_usd":36000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":714},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Copilot","optional":false},{"name":"GCP","optional":false},{"name":"GDPR","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false},{"name":"Least Privilege","optional":true},{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-09-16T06:46:56Z","employer_posted_date":null,"last_verified_at":"2026-09-16T06:46:56Z","board_verified":false,"closed_at":null,"days_open":31,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":31},"description":"Role : Security Engineer\n\nInfrastructure & Security - Bengaluru - Full-Time - On-Site\n\nAbout OTPless : \n\nOTPless is India's authentication company - and we're on a mission to make OTPs obsolete.\n\nWe help enterprises deliver the fastest, most seamless login experience while improving both conversion and security. Built for high-scale internet companies, OTPless transforms login from a friction point into a measurable growth lever. India's top unicorns trust us. We authenticate 200M+ mobile identities every month - at population scale.\n\nWe've raised $8M from tier-1 global investors including General Catalyst, SIDBI, and FJ Labs. We're 10 people with the ambition of 1,000.\n\nTeam & Culture : \n\nOur founders are former unicorn builders - people who know what scale, velocity, and disciplined execution actually look like. We operate with the urgency of a startup and the standards of a high-performance institution.\n\nWe reward merit, action, ownership, integrity, and ethics. Impact beats titles. Accountability beats activity.\n\nIf you want disproportionate responsibility, direct founder access, and the chance to shape a product category from the ground up - you'll love it here.\n\nThe Role : \n\nWe're hiring a Security Engineer whose primary mandate is to raise and continuously improve the security posture of OTPless - across our product, infrastructure, and people.\n\nAuthentication is the most security-sensitive layer of any product stack. Our clients - India's top unicorns and fast-scaling enterprises - trust OTPless to protect 200M+ identities every month. That trust is earned through rigorous, proactive security. This role owns it.\n\nYou'll lead vulnerability assessments, harden production systems, drive compliance across SOC 2, ISO 27001, GDPR, and PCI-DSS, own endpoint security, and build a security-first culture through training and awareness. You'll also be our frontline defence against the rapidly growing class of AI-powered threats - prompt injection, automated credential attacks, AI-generated phishing, and adversarial model abuse.\n\nThis is a high-trust, high-ownership IC role. You'll work closely with Engineering, Infrastructure, and Leadership - and your work will directly determine how much enterprise clients trust us with their most critical user flows.\n\nSecurity isn't a checklist here. It's a competitive advantage - and you'll be the one building it.\n\nWhat You'll Do : \n\n- Own the end-to-end security posture of OTPless - identify gaps, prioritise risks, and drive remediation across teams.\n\n- Conduct regular vulnerability assessments and penetration tests across production systems, APIs, mobile SDKs, and cloud infrastructure.\n\n- Perform static and dynamic application security testing (SAST/DAST) and track findings to closure.\n\n- Manage a responsible disclosure / bug bounty programme and triage external security reports.\n\n- Monitor CVEs, threat intelligence feeds, and security advisories relevant to our stack and act proactively.\n\n- Harden cloud infrastructure (AWS/GCP/Azure) - IAM policies, network segmentation, secrets management, and least-privilege enforcement.\n\n- Implement and maintain security controls across CI/CD pipelines - dependency scanning, container security, and secure build practices.\n\n- Oversee endpoint security across all company devices - MDM, EDR tooling, patch management, and access controls.\n\n- Conduct threat modelling for new product features and infrastructure changes before they ship.\n\n- Define and enforce secure coding standards; embed security reviews into the engineering workflow.\n\n- Identify and mitigate emerging AI-powered attack vectors - automated credential stuffing, AI-generated phishing, adversarial prompt injection, and synthetic identity fraud.\n\n- Assess risks introduced by internal AI tool usage (LLM integrations, copilot tools, AI-assisted workflows) and establish guardrails.\n\n- Stay current on the evolving AI threat landscape and translate research into practical defensive controls.\n\n- Drive and maintain compliance with SOC 2, ISO 27001, GDPR, and PCI-DSS - including evidence collection, gap remediation, and audit readiness.\n\n- Liaise with external auditors, certification bodies, and enterprise clients during security assessments.\n\n- Maintain security policies, procedures, and documentation to audit-ready standards at all times.\n\n- Track regulatory changes across applicable frameworks and update internal controls accordingly.\n\n- Design and run security awareness training for all employees - phishing simulations, secure coding workshops, and onboarding modules.\n\n- Champion a security-first engineering culture - make secure-by-default the path of least resistance for every team.\n\n- Build incident response playbooks and lead tabletop exercises to keep the team prepared.\n\n- Act as the internal point of contact for security questions, escalations, and policy guidance.\n\nWhat We're Looking For : \n\nMust-Have : \n\n- 4 - 5 years of hands-on experience in application security, infrastructure security, or a broad security engineering role.\n\n- Proven experience conducting vulnerability assessments and penetration tests across web applications, APIs, and cloud environments.\n\n- Strong working knowledge of cloud security on AWS, GCP, or Azure - IAM, VPCs, secrets management, and security monitoring.\n\n- Hands-on experience with SAST/DAST tools, dependency scanning, and secure CI/CD practices.\n\n- Deep familiarity with compliance frameworks : SOC 2, ISO 27001, GDPR, and PCI-DSS - including audit preparation and evidence management.\n\n- Solid understanding of endpoint security - MDM, EDR tools, patch management, and device policy enforcement.\n\n- Awareness of AI-powered attack vectors and how to defend against them in a production authentication environment.\n\n- Strong written communication - able to write clear policies, audit evidence, and risk reports for both technical and non-technical audiences.\n\n- Ownership mindset - you don't wait for security incidents; you prevent them.\n\nGood to Have : \n\n- Industry certifications : OSCP, CEH, CISSP, CISM, AWS Security Specialty, or equivalent.\n\n- Experience with authentication protocols and identity security - OAuth 2.0, OpenID Connect, OTP systems, or similar.\n\n- Familiarity with mobile security (Android/iOS) - relevant given OTPless's SDK footprint.\n\n- Experience running a bug bounty or responsible disclosure programme.\n\n- Prior work at a fintech, identity, or developer-tools company where security is product-critical.\n\n- Experience with SIEM tools, log analysis platforms, or threat detection pipelines.\n\nWhat's in It for You : \n\n- Own the security function at a company protecting 200M+ mobile identities - with full leadership visibility and trust.\n\n- Work on a genuinely security-critical product - authentication is the frontline, and your work directly protects it.\n\n- Direct access to founders and engineering leadership; your recommendations will be heard and acted on.\n\n- Competitive compensation aligned with your experience.\n\n- A fast-evolving threat landscape - especially with AI - that will keep you sharp and learning every week.\n\n- High-trust, outcomes-driven culture without micromanagement.\n\n- Mentorship from senior engineering leadership including ex-BharatPe builders.\n\nWhy This Role Matters : \n\nOTPless sits at the intersection of authentication, identity, and mobile - three areas that attract sophisticated, well-resourced attackers. Our enterprise clients trust us with the login layer of their products. Any breach, vulnerability, or compliance failure doesn't just affect us - it affects every user across every client we serve.\n\nAt the same time, AI is fundamentally changing the threat surface. Attacks are faster, more convincing, and more automated than ever. We need someone who understands this shift - and builds defences that stay ahead of it.\n\nAs our first dedicated Security Engineer, you won't be inheriting a mature, documented security programme. You'll be building one - from policy to tooling to culture. That's a rare opportunity for an engineer who wants to own something that genuinely matters.\n\nIf hardening systems, staying ahead of threats, and making security a product advantage sounds like your kind of work - let's talk.\nSkills\nCyber Security, Security, Security Operations Center, ISO, PCI-DSS, SAST, DAST, Cloud Infrastructure, Vulnerability Assessment, Endpoint Detection & Response, CISSP","description_format":"text","description_chars":8423,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":[],"lifecycle":[{"event":"open","at":"2026-09-25T18:04:06Z"}],"visa":[],"liveness":{"score":23,"band":"cold","label":"Long shot","p_open":0.6,"p_active":0.697,"p_room":0.55,"age_days":30,"expected_fill_days":30,"reasons":["seen:30","win:tail"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/snaphyr-security-engineer","json_url":"https://alion.io/job/snaphyr-security-engineer.json","meta":{"generated_at":"2026-10-18T00:40:55Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1199,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3806601},"rest":"https://alion.io/mcp/rest/get_company?id=3806601"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsnaphyr-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsnaphyr-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsnaphyr-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/snaphyr-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsnaphyr-security-engineer"}]}