{"id":3481724,"url":"https://alion.io/job/sonata-software-security-software-engineer","title":"Security Software Engineer","company":{"id":5150,"name":"Sonata Software","domain":"sonata-software.com","url":"https://alion.io/company/sonata-software","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Pune, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":17500,"max_usd":38000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Apache HTTP Server","optional":false},{"name":"C#","optional":false},{"name":"CI/CD","optional":false},{"name":"CloudFormation","optional":false},{"name":"CVSS","optional":false},{"name":"Docker","optional":false},{"name":"Git","optional":false},{"name":"Go","optional":false},{"name":"GraphQL","optional":false},{"name":"IAM","optional":false},{"name":"JavaScript","optional":false},{"name":"Kotlin","optional":false},{"name":"Kubernetes","optional":false},{"name":"Nginx","optional":false},{"name":"PHP","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Terraform","optional":false},{"name":"TypeScript","optional":false},{"name":"AWS","optional":true},{"name":"Burp Suite","optional":true},{"name":"CodeQL","optional":true},{"name":"ISO 27001","optional":true},{"name":"OWASP ASVS","optional":true},{"name":"OWASP Top 10","optional":true},{"name":"PCI DSS","optional":true},{"name":"Semgrep","optional":true},{"name":"SOC 2","optional":true},{"name":"Threat Modeling","optional":true}],"status":"live","first_seen_at":"2026-10-29T17:30:39Z","employer_posted_date":null,"last_verified_at":"2026-10-29T17:30:39Z","board_verified":false,"closed_at":null,"days_open":5,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":5},"description":"Software Engineer (Security)\nLocation: Pune (Hybrid)\nExperience: 5+ years (about 70% software development, 30% security)\nAbout the role\nThis is a development-first security role. About 70% of the work is engineering: you will fix vulnerabilities in application code, upgrade vulnerable components, and build the tooling and automation that keep issues from coming back. The other 30% is security testing across our web apps and APIs. You own each fix end to end, from the finding to a merged, tested change.\n\nWhat you will do\nDevelopment and remediation\nFix vulnerabilities directly in application code, in whatever language or framework the application uses, and add tests that prove the fix.\nFix root causes, not single instances: build shared validation, output encoding, parameterized queries, and authorization checks that remove whole classes of vulnerabilities.\nUpgrade vulnerable libraries, frameworks, and third-party components, resolve breaking changes, and keep builds and tests passing.\nBuild internal security tooling and automation: scanner integrations, triage and reporting scripts, and checks that catch issues before release.\nIntegrate SAST, DAST, and SCA tooling such as Aikido into CI/CD pipelines, and tune the rules to cut noise.\nFix infrastructure and configuration issues: web server and TLS settings, cloud IAM and network rules, container and Kubernetes configuration, infrastructure-as-code, and CI/CD pipeline hardening.\nWhere code or infrastructure is owned by another team, raise the change yourself as a pull request and drive it to merge.\nSecurity testing\nTest web applications and APIs for exploitable vulnerabilities.\nReview code and design for flaws in authentication, authorization, session handling, data flows, and secrets management.\nRun and tune vulnerability scans across applications, hosts, or cloud accounts, and prioritize findings by exploitability and business impact alongside CVSS.\nRetest fixes and close findings only when the vulnerability is confirmed resolved.\nReporting and communication\nWrite clear findings and fix notes with reproduction steps, evidence, risk rating, and the change made.\nAgree on realistic remediation timelines with engineers, and share secure coding patterns so the same issues stop recurring.\nWhat you bring\nExperience\n5+ years total: approx. 3.5 years building and shipping production software as a developer, and approx. 1.5+ years of hands-on security work such as VAPT, application security, or secure code review.\nA track record of fixing security issues in code.\nDevelopment expertise\nProduction-level depth in at least two of: Java, C#/.NET, JavaScript/TypeScript, Python, PHP, Go, Swift, or Kotlin. Comfortable reading and changing code in languages you know less well.\nAble to land a correct, tested fix in an unfamiliar codebase without breaking existing behavior.\nWeb and API development: REST and GraphQL services; authentication with OAuth 2.0, OpenID Connect, and JWT; session management; databases and ORMs.\nUnit and integration testing, Git-based workflows, pull requests, and code review.\nCI/CD pipelines, Docker, Kubernetes, and infrastructure-as-code such as Terraform or CloudFormation.\nWorking knowledge of Nginx, Apache, IIS, and TLS configuration.\nScripting in Python, Bash, or PowerShell to automate testing and remediation.\nCommunication\nClear written findings and the ability to explain risk and trade-offs to engineers and business stakeholders.\nNice to have\nWeb and API: manual testing with Burp Suite Professional; OWASP Top 10 and ASVS; injection, authentication and session flaws, access control (IDOR/BOLA), SSRF, and OAuth and JWT weaknesses.\nSecure code review: spotting vulnerable patterns in code and using SAST and SCA results to find and fix real issues.\nBuilt security tools, Burp extensions, or custom SAST rules (for example, Semgrep or CodeQL).\nThreat modeling and secure design review experience.\nFamiliarity with compliance evidence requirements (ISO 27001, SOC 2, PCI DSS) as they relate to vulnerability remediation.\nWhat success looks like\nVulnerabilities reach merged, tested fixes within agreed timelines.\nRecurring vulnerability classes decline because fixes address root causes.\nThe tooling and automation you build catch issues before release and cut manual triage.\nDevelopment teams see you as a fellow engineer who ships fixes alongside them.\nCloud misconfiguration and patch exposure windows stay short.","description_format":"text","description_chars":4437,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["IT Consulting & Digital Transformation","IT Outsourcing & Dedicated Teams"],"lifecycle":[{"event":"open","at":"2026-10-29T20:10:15Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":5,"expected_fill_days":29,"reasons":["seen:5","velocity","win:early"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/sonata-software-security-software-engineer","json_url":"https://alion.io/job/sonata-software-security-software-engineer.json","meta":{"generated_at":"2026-11-04T09:03:54Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14130,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5150},"rest":"https://alion.io/mcp/rest/get_company?id=5150"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsonata-software-security-software-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsonata-software-security-software-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsonata-software-security-software-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sonata-software-security-software-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsonata-software-security-software-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3481724}},{"tool":"search_jobs","arguments":{"company":"sonata-software.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3481724},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}