Senior Information Security Engineer

This is a fully remote position, open to applicants in India.

📋 Description

• Take ownership of the complete vulnerability management lifecycle across products and their supporting technologies.

• Identify, assess, prioritize, track remediation efforts, manage risk acceptances, and report on vulnerabilities.

• Triage and validate findings from SAST, DAST, SCA, secrets scanning, penetration testing, and web application scanning.

• Collaborate with Engineering and Product teams to drive remediation efforts and adhere to remediation timelines.

• Partner with teams to integrate security tools into CI/CD pipelines.

• Enhance the quality, coverage, and effectiveness of security tools.

• Develop and refine risk-based vulnerability prioritization utilizing exploitability, asset exposure, business criticality, threat intelligence, and compensating controls.

• Identify recurring vulnerability trends and root causes to mitigate systemic weaknesses.

• Enhance vulnerability management processes, dashboards, and workflows.

• Support security evaluations of software supply chain risks, dependency management, build pipeline security, and secure software development practices.

• Review and validate findings related to cloud security and Cloud Security Posture Management (CSPM).

• Assist Infrastructure and Engineering teams in prioritizing and addressing cloud vulnerabilities and configuration issues.

• Investigate emerging cloud threats, vulnerabilities, and misconfiguration patterns.

• Suggest mitigations and assist in implementing cloud security controls and security baselines.

⛳️ Requirements

• Strong technical expertise in application security, vulnerability management, or software engineering.

• Clear comprehension of how vulnerabilities are created and the appropriate remediation processes.

• Hands-on experience with SAST, DAST, SCA, and secrets scanning.

• Experience in integrating security tools within modern CI/CD environments.

• Ability to evaluate vulnerabilities based on exploitability, internet exposure, asset criticality, available exploits, and compensating controls.

• Experience in software supply chain security, including SLSA, dependency security, and secure build pipelines.

• Strong foundation in public cloud security, particularly with AWS and/or Azure.

• Understanding of cloud vulnerabilities, including overly permissive identities, exposed services, insecure storage, vulnerable workloads, and configuration drift.

• Experience in vulnerability management is required on the application form.

🏝️ Benefits

• One-way (Drop) transport will be provided for female colleagues.

• Opportunities for continuous learning and career development.

• A culture that celebrates diversity and empowers every individual.

• Workplace accommodations and adjustments during the hiring process.

• Full-time permanent employment.