Security Engineer

Job Summary:

We are looking for a highly motivated Security Engineer with a strong passion for cybersecurity and a willingness to learn and grow. In this role, you will collaborate with Security, DevOps, and Development teams to identify vulnerabilities, mitigate risks, and strengthen the overall security posture of our applications and infrastructure.

Key Responsibilities:

• Perform penetration testing on web applications, APIs, and native mobile applications; document findings and track remediation to closure.
• Conduct threat modelling for development initiatives to identify and mitigate potential security risks.
• Monitor security alerts and actively participate in incident response and investigation activities.
• Support and ensure compliance with industry security standards and regulatory requirements.
• Develop and maintain security documentation, including SOPs and knowledge base articles.
• Involved in security awareness and training sessions to development and cross-functional teams.
• Assist in completing client security questionnaires and third-party security assessments.

Must-Have Skills:

• Strong hands-on experience in penetration testing (Web, API, or Mobile).
• In-depth knowledge of OWASP Top 10 (2025) vulnerabilities and mitigation techniques.
• Experience working with Secure Software Development Lifecycle (SSDLC) in Agile environments.
• Understanding of Threat Modelling, Risk Management, Secure Coding, Cloud Security and DevSecOps practices.
• Solid technical foundation in security research and vulnerability assessment.
• Familiarity with vulnerability scanners and interpreting their findings.
• Knowledge of Network Penetration Testing concepts.
• Experience with WAF security and event/log analysis.
• Strong documentation and communication skills.

Good to Have:

• Relevant security certifications such as CEH, Security+, eJPT, or eWPT (at least one preferred).
• Familiarity with compliance standards such as PCI-DSS, SOC 2, and ISO 27001.
• Exposure to bug bounty programs or responsible disclosure platforms.
• Programming/scripting knowledge in JavaScript, Python, or Bash.
• Understanding of security testing tools and methodologies such as SAST, DAST, and SCA.