Senior Security & Compliance Engineer

Senior Security & Compliance Engineer

Designation:

Educational Qualification

One of the following (Must have):

• B.Tech./B.E. in Computer Science, Information Technology, Cybersecurity, or related engineering discipline,

  OR

• M.Tech./M.S. in Information Security, Cybersecurity, Applied Cryptography, or related field

At least one of the following certifications required at deployment (Must have):

• CISSP, CISM, CEH, OSCP, GWAPT, CSSLP, or CompTIA Security+

ISO 27001 Lead Auditor and privacy certifications (DCPP, DPO training) additionally desirable.

Experience

• 7+ years in application security, security testing, or security compliance for enterprise or government platforms, with hands-on secure development guidance experience
• Demonstrated experience conducting or coordinating VAPT (vulnerability assessment and penetration testing), STQC certification, or equivalent third-party security audits
• Demonstrated experience defining secure coding standards, conducting secure design reviews, and providing security guidance to engineering teams
• Prior experience with government security frameworks MeitY Security Policy, CERT-In guidelines, ISO 27001 — required
• Familiarity with DPDPA 2023 and data-protection compliance operationalisation required
• Prior exposure to AI-specific security concerns (prompt injection, data poisoning, model extraction, adversarial inputs) desirable

Key Responsibilities

Application Security Engineering & Secure Development

1. Own the application security engineering practice for the AI capability programme — define secure coding standards, threat modelling methodology, secure design review process, and security acceptance criteria for pod services
2. Conduct threat modelling and secure design reviews for each pod's services and their integration surfaces (STRIDE, LINDDUN, or equivalent); document threats, mitigations, and residual risks
3. Provide hands-on secure development guidance to pod engineers and Full-Stack Engineers on authentication and session design, authorisation patterns, input validation, output encoding, secure API design, secrets handling, and DPDPA-compliant consent and data-minimisation patterns
4. Define encryption standards (AES-256 at rest, TLS 1.3 in transit, key management), tokenisation approaches, and secure data-handling patterns for classified, internal, and public workloads per the Government of India Data Classification Policy
5. Review and approve authentication and authorisation designs, particularly for high-risk pods (Pod 4 identity verification, Pod 6 fraud detection) and Aadhaar-adjacent flows where applicable
6. Advise on AI-specific security concerns — prompt injection defence, data poisoning risk, model extraction, adversarial input handling, output filtering, RAG source integrity — in coordination with the AI Safety Researcher and Product Managers

Security Testing

1. Design and execute the application security testing programme — SAST, DAST, SCA, secrets scanning, dependency vulnerability management — integrated into the CI/CD pipelines maintained by DevOps/SRE
2. Coordinate VAPT engagements for each pod's services prior to production deployment, including scoping, vendor coordination, and remediation tracking
3. Coordinate STQC or equivalent third-party security certification for citizen-facing services as required per ministry deployment
4. Conduct manual security review, code audit, and configuration review for high-risk services and Aadhaar-adjacent flows
5. Perform periodic security assessments of live services — access review, configuration drift, exposed secrets, dependency currency — and drive remediation

Compliance & Audit

1. Own compliance evidence and audit artefacts across the programme — control mapping, evidence collection, gap analysis, and remediation tracking for ISO 27001, MeitY Security Policy and Guidelines, and CERT-In directions per LoE Sections 10.2, 12, and 13
2. Operationalise DPDPA 2023 compliance across all pods — consent architecture review, data principal rights fulfilment procedures, retention and deletion procedures, cross-border transfer controls, and data-processor obligations
3. Own the Responsible AI compliance artefacts required by LoE Section 12.3 and 13.6 — model cards, dataset sheets, and bias/hallucination/safety evaluation report structures — in coordination with pod leads (technical safety evaluation content is authored by the AI Safety Researcher; this role owns the compliance framing, publication cadence, and audit readiness)
4. Manage the security-incident reporting process per LoE Section 10.4 — 24-hour breach reporting to NeGD/Government Entity, root-cause analysis, and 7-working-day corrective action report submission
5. Maintain the risk register for security and compliance risks; feed into the programme risk register owned by Product Managers
6. Prepare and support internal and external audits — evidence packages, control walkthroughs, auditor coordination

Cross-cutting

1. Partner with DevSecOps/SRE Lead on the boundary between application security (this role) and infrastructure security (DevSecOps/SRE) — network policies, WAF rule design, secrets management standards, and audit-log architecture
2. Advise the Product Managers and the AI/Solution Architect on security and compliance trade-offs in product and architectural decisions
3. Contribute reusable security patterns, secure design templates, threat model libraries, and compliance runbooks to AIKosh and OpenForge for reuse across ministries

Technical Competencies

1. Application Security Engineering:

   Secure SDLC, threat modelling (STRIDE, LINDDUN, PASTA), secure design review, secure coding standards (OWASP ASVS), attack surface analysis

2. Vulnerability Assessment & Penetration Testing:

   Manual and automated VAPT for web applications, APIs, and microservices; familiarity with OWASP Testing Guide; hands-on with Burp Suite, OWASP ZAP, Metasploit, or equivalent

3. Application Security Testing Tooling:

   SAST (SonarQube, Semgrep, Checkmarx), DAST (OWASP ZAP, Burp), SCA (Snyk, Dependency-Track, Trivy), secrets scanning (Gitleaks, TruffleHog), container scanning

4. Cryptography & Key Management:

   AES-256, TLS 1.3, PKI, HSM basics, secrets management (HashiCorp Vault, Infisical), certificate lifecycle

5. Identity & Access:

   OAuth 2.0, OpenID Connect, SAML, RBAC/ABAC design; familiarity with Aadhaar authentication patterns, DigiLocker, e-Sign, and India Stack security models

6. AI-Specific Security:

   Prompt injection defence, RAG source-integrity controls, PII redaction in conversation logs, adversarial input handling, model extraction risk, awareness of MITRE ATLAS

7. Compliance Frameworks:

   ISO 27001, MeitY Security Policy and Guidelines, CERT-In directions (including the 6-hour reporting rule and log-retention requirements), STQC framework, NIST CSF familiarity

8. Data Protection:

   DPDPA 2023 (operational implementation of consent, data principal rights, retention, cross-border transfer, notification obligations), GDPR familiarity, Government of India Data Classification Policy

9. Responsible AI Compliance:

   MeitY Responsible AI Guidelines, model cards, dataset sheets, system cards, bias/hallucination/safety report structures

10. Audit & Evidence Management:

    Control mapping, evidence collection workflows, GRC tooling familiarity (Archer, ServiceNow GRC, or open-source equivalents)

11. Scripting:

    Python or Bash for security automation, evidence collection, and integration into CI/CD

12. Communication:

    Ability to translate security and compliance requirements into engineering guidance; ability to present risk and compliance posture to executive leadership, auditors, and ministry stakeholders