Lead Security Engineer

Key responsibilities:

• Secure Architecture & SDLC:

  Design and build secure systems across all layers (network, OS, application), implement AppSec and Secure SDLC practices including SAST, DAST, and SCA.

• Cloud & Container Security:

  Develop and enforce security best practices for containerization, ECS, and Kubernetes, and manage secrets/key management.

• API Security:

  Ensure the security of GraphQL and REST APIs.

• DevSecOps & Automation:

  Drive DevSecOps enablement by integrating security into CI/CD pipelines and implement SOAR for automated incident response.

• Security Operations (SOC):

  Oversee and mature SOC operations, including SIEM management, log correlation, incident response (IR) runbooks and drills, and integration of threat intelligence for proactive threat hunting.

• Vulnerability Management & Testing:

  Lead internal/external VAPT, conduct penetration testing (web, API, mobile, cloud), plan red/purple team exercises, coordinate phishing simulations, and manage bug bounty programs and the Coordinated Vulnerability Disclosure (CVD) process.

• Vulnerability Remediation & Hardening:

  Drive post-VAPT remediation, manage vulnerability scanning, track patch management/misconfigurations, establish infrastructure baselining (CIS, STIGs), and report on exposure windows.

• Collaboration & Mentorship:

  Collaborate with engineering, SRE, and IT to embed security, and mentor junior security engineers.

Required Qualifications:

• 8+ years of experience in Security Engineering, AppSec, DevSecOps, or a related security-focused role.

• Proficiency in at least one modern programming language

  (e.g., Go, Python, Java).
• Strong understanding of secure architecture principles for network, OS, and application layers.
• Hands-on experience with AppSec tooling (SAST, DAST, SCA) and implementing Secure SDLC.
• Proven experience with container/ECS/Kubernetes security.
• Deep knowledge of secrets and key management solutions.
• Experience with API security, including GraphQL and REST.
• Demonstrable experience with DevSecOps enablement and pipeline integrations.
• Strong knowledge of incident management frameworks and leading high-severity incident response.
• Experience with SIEM and log correlation tools.
• Familiarity with threat intelligence feeds and proactive threat hunting.
• Proven track record of conducting VAPT, penetration testing, and red/purple team exercises.
• Experience managing bug bounty programs and external security testing vendors.
• Hands-on experience with vulnerability scanning and configuration management.
• Excellent communication, documentation, and collaboration skills.

Preferred Qualifications:

• Prior experience in a high-scale production environment.
• Certifications in Security (e.g., OSCP, OSWE, CISSP, GSEC, AWS Certified Security - Specialty).
• Experience with SOAR platforms and automating security workflows.
• Knowledge of compliance frameworks (e.g., ISO 27001, SOC 2).