{"id":1069829,"url":"https://alion.io/job/zeta-product-security-engineer-ii-2","title":"Product Security Engineer II","company":{"id":95345,"name":"Zeta","domain":"zeta.tech","url":"https://alion.io/company/zeta-tech","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":83,"open_postings":6,"ghost_share":0,"stale_share":0.667,"repost_share":0,"time_to_fill_p50_days":45,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Hyderabad, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":14000,"max_usd":34000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":714},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"Amazon Redshift","optional":false},{"name":"Amazon S3","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Burp Suite","optional":false},{"name":"Checkmarx","optional":false},{"name":"CI/CD","optional":false},{"name":"ElasticSearch","optional":false},{"name":"Frida","optional":false},{"name":"GDPR","optional":false},{"name":"Java","optional":false},{"name":"Jenkins","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"Metasploit","optional":false},{"name":"Nessus","optional":false},{"name":"Objection","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"OWASP ZAP","optional":false},{"name":"PCI DSS","optional":false},{"name":"PKI","optional":false},{"name":"PostgreSQL","optional":false},{"name":"Python","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"Ruby","optional":false},{"name":"Snyk","optional":false},{"name":"SonarQube","optional":false},{"name":"SQL","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Veracode","optional":false},{"name":"Windows","optional":false},{"name":"Cloudflare","optional":true},{"name":"Cloudflare WAF","optional":true}],"status":"live","first_seen_at":"2026-07-21T11:10:26Z","employer_posted_date":"2026-07-21","last_verified_at":"2026-10-19T04:22:26Z","board_verified":true,"closed_at":null,"days_open":89,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":89},"description":"About us:\nBuild the future of banking.\n\nZeta is a next-generation banking technology company providing cloud-native, fully stackable processing and core banking platforms for issuers. With a focus on scalability, compliance, and innovation, Zeta empowers financial institutions to modernize their technology infrastructure and deliver secure, seamless digital banking experiences.\nOur impact runs at real-world scale. Today, over 25 million cards are live on Zeta-powered platforms across 7 countries, supported by a passionate team of 1,700+ Zetanauts across India, the US, EMEA, and Asia. Backed bySoftBank Vision Fund, Mastercard, and other reputed strategic investors, we reached a valuation of $2 billion in 2025.\nOur focus is on establishing product lines that focus on key outcomes by addressing real customer pain points, modernizing legacy systems, and strengthening core fundamentals. As a result, our systems and platforms support a wide range of banking and payments capabilities, including:\n1. Tachyon, our cloud-native banking stack built for population-scale systems\n2. Cipher, our unified authentication platform for secure, high-volume banking environments\n3. Digital Credit as a Service, enabling banks to launch credit lines on UPI\n4.Elena, our intelligent and conversational AI platform for banking\n5. Pixel, India’s first digital-native credit card, launched in partnership with HDFC Bank, for whom we also revamped their PayZapp mobile app: Winner of the Celent Model Bank Award for Payments Innovation 2024\n6. Sparrow, the leading card experience for non-prime cardholders in the US\n…and more across cards, payments, lending, and core banking.\nWe are an engineering-first organization that values ownership, bias for action, and long-term thinking. Together, we solve some of the hardest problems in banking tech. Our culture is built around trust, collaboration, and creating the conditions for you to drive impact proportionate to your potential. Reinforcing our commitment to creating an inclusive and supportive workplace, we have been consistently recognized as a Great Place to Work.\nIf you want to build cutting-edge banking tech that enables banks to serve millions reliably, securely, and at a population scale, Zeta is your playground.\nIf you would like to learn more about how we have grown and evolved over the years, watch our journey here. You can also explore our website and follow us on LinkedIn,Instagram,YouTube, andX.\nAbout the Role:\nThis role is part of the Risk & Compliance Team, Engineering division of Zeta. The Product Security Engineer is responsible to secure all mobile & web applications along with API’s by breaking and hacking them and educating Developers as well as DevOps teams on how to fix them. The objective is to make zeta applications and platforms secure. As Application Security Engineer of the Product Security sub-division, you will be responsible for securing all the Zeta’s Products. You will be working as an individual contributor reporting to a manager.\nPerform regular VA/PT for Web & Mobile applications, API & Infrastructure\n\nGuide developers in fixing security issues.\n\nRegular code reviews\n\nInvolve in application design discussions.\n\nPerform Threat Modelling of Web/Mobile applications.\n\nDevelop secure code practices and educate dev and QA engineers by building security standards, policies for secure coding, secure data handling, secure networking, secure crypto implementation, etc.\n\nEvaluate & Integrate security testing tools (SAST, DAST,SCA) in to CI/CD pipelines.\n\nResponsibilities:\nGuide the technology organization's security and privacy initiatives by participating in design reviews and threat modeling.\n\nThe applications are developed by the developers and product managers, and you will make sure the applications are secured and hardened.\n\nYou will define the scope and ensure continuous adherence to the scope of projects at each phase (initiation to sustenance/maintenance phase).\n\nYou will be responsible for creating visibility, and adoption of the projects meant for internal customers.\n\nAct as a security engineering expert and technical champion within Zeta.\n\nAssess gaps, and tools to improve application security\n\nLiasioning with all external and internal stakeholders for the team.\n\nMentoring developers and QA.\n\nEvaluate bugs reported through the Bug Bounty program.\n\nRun security posture of various applications across BU’s.\n\nContinuous improvement of web/mobile application security\n\nQuarterly VA/PT (internal/external, authenticate/non-authenticated) for mobile/web.\n\nSecure configuration of Web/Mobile application, DB, Data etc.\n\nSkills:\nHands on VA/PT experience in Web, Mobile, SDK, API & Network\n\nThorough understanding of OWASP Top 10, their attack & defense mechanisms\n\nExposure to Secure SDLC Activities, Threat Modelling & Secure Coding\n\nExperience with both commercial and open-source tools like Burp suite, AppScan, OWASP ZAP, BEEF, Metasploit, Qualys, Nessus, Synk etc.\n\nIdentifying and exploiting business logic-related vulnerabilities.\n\nSolid understanding of Cryptography, knowledge of PKI-based systems, TLS\n\nUnderstanding of different AuthN/AuthZ frameworks (OIDC, oAuth, SAML) able to read/write/understand java code\n\nPerformed Static Analysis, Code reviews using tools like Snyk, Veracode, Checkmarx, Sonarqube etc.\n\nHands on Reversing mobile applications, class/small files, data obfuscators, or ciphers (Dex2jar, adb, Drozer, Clang, iMAS) and Dynamic Instrumentation tools like Frida/Objection\n\nExecute penetration tests and security assessments on internal and external networks, Windows and Linux environments, cloud (AWS) Infrastructure.\n\nIdentify and exploit incorrect configurations and security vulnerabilities on Windows and Linux servers. Safely utilize tools, tactics, and procedures used in penetration testing engagements.\n\nShell scripting or automation of simple tasks using Python, or Ruby\n\nKnowledge of PCI DSS, PCI SSF (S3, SSLC) etc.\n\nKnowledge of security standards like PCI DSS, UIDAI, GDPR, NIST, etc.\n\nUnderstanding Java Frameworks like Springboot, CI/CD, Jenkins.\n\nIn-depth understanding of production operations on public cloud infrastructure.\n\nExcellent written and oral communication and a penchant for technical documentation.\n\nMust have participated in various bug bounty programs (HackerOne, Bug Crowd, Private etc)\n\nExperience in conducting hackathons and CTF’s\n\nKnowledge of AWS/Azure (VPC/Vnet, S3 buckets, blob stores, LoadBalancers etc.), Dockers & Containers, Kubernetes\n\nGood understanding of agile development practices.\n\nCertifications like OSCP(Preferred), GWAPT, Advanced Web Attacks and Exploitation (AWAE), Comptia Security+\n\nKnowledge of Databases - Postgresql, Redshift, My SQL etc. and other data stores like Elasticsearch and S3 buckets.\n\nExperience in the FinTech domain is highly desirable.\n\nKnowledge of payment key management, cryptographic key handling, and HSM operations will be an added advantage.\n\nCloudflare WAF experience or knowledge in the areas:\n\nCloudflare WAF Rules Review and Configuration\n\nCloudflare WAF Rules Tuning\n\nCloudflare Traffic and Event Monitoring\n\nBot Traffic Analysis\n\nDetecting and handling anonymous or un-authenticated API Calls.\n\nExperience and Qualifications:\n4+ years of experience in developing large scale internet or SaaS applications.\n\n2 to 3 years of overall experience as Web/Mobile Application Security engineer or Developer in medium to large-sized product companies.\n\nBachelor of Technology (BE/B.Tech), M.Techor ME in Computer Science or equivalent from a Tier-1 engineering college/university.","description_format":"text","description_chars":7613,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cards & Card Issuing","Financial Software & Embedded Finance"],"lifecycle":[{"event":"open","at":"2026-09-20T00:47:08Z"}],"visa":[],"liveness":{"score":17,"band":"cold","label":"Long shot","p_open":1,"p_active":0.476,"p_room":0.36,"age_days":87,"expected_fill_days":45,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/zeta-product-security-engineer-ii-2","json_url":"https://alion.io/job/zeta-product-security-engineer-ii-2.json","meta":{"generated_at":"2026-10-19T05:27:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3306,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":95345},"rest":"https://alion.io/mcp/rest/get_company?id=95345"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fzeta-product-security-engineer-ii-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fzeta-product-security-engineer-ii-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fzeta-product-security-engineer-ii-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/zeta-product-security-engineer-ii-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fzeta-product-security-engineer-ii-2"}]}