Security Engineer 2

Role & responsibilities

We at Innovaccer are looking for a Security Engineer-II for Product Security who will be responsible for End to End Security of the entire solution. This role will encompass the use of a broad range of security domains (Application Security Web, Mobile & Desktop, Data Security, Cloud Security, Automation, VAPT).This role would be a great opportunity to learn and grow as you would be exposed to multiple security domains at single time.

A Day in the Life

•    Perform Black Box, White Box, Grey Box, Web, API, and AI/LLM application penetration testing to identify security vulnerabilities across products and services.
• Conduct AI/LLM security assessments and red teaming exercises in alignment with OWASP LLM Top 10 and emerging AI security best practices.
• Perform security architecture reviews, threat modeling, and secure design assessments for new products, features, APIs, and cloud-native applications.
• Assess applications against OWASP Top 10, OWASP API Security Top 10, OWASP LLM Top 10, and industry security standards.
• Work closely with Product, Engineering, DevOps, Infrastructure, Platform Engineering, and SRE teams to remediate security vulnerabilities and implement secure-by-design principles.
• Provide security guidance throughout the Secure Software Development Lifecycle (SSDLC), including design reviews, code reviews, and release security assessments.
• Conduct secure code reviews and assist engineering teams in implementing secure coding practices.
• Perform cloud security assessments across AWS, Azure, and GCP environments, including cloud-native services, IAM, networking, containers, and Kubernetes.
• Collaborate with Infrastructure, Data Security, SRE, and DevOps teams to implement, validate, and periodically test Business Continuity (BCP) and Disaster Recovery (DR) solutions
• Develop security use cases, dashboards, reports, and metrics to improve visibility into product security posture.
• Develop scripts and automation to improve penetration testing, vulnerability validation, and security assessment efficiency.
• Support vulnerability management by validating remediation, performing retesting, and working with engineering teams to drive timely closure of security findings.
• Participate in incident response activities involving application and product security when required.
• This role requires being available on call during weekends and off hours. 

Preferred candidate profile

• Bachelor's degree (engineering) in Computer Science, Information Technology, Cyber Security, or a related field.
• Minimum 3-5 years of experience in Product Security, Application Security, or Penetration Testing.
• Experience conducting AI/LLM security testing and familiarity with OWASP LLM Top 10 is highly desirable.
• Hands-on experience with penetration testing tools such as Burp Suite Professional, OWASP ZAP,Nmap, Nessus, OpenVAS, SQLMap, Metasploit, and similar tools.
• Familiarity with SAST, DAST, SCA, Container Security, Infrastructure as Code (IaC), and Secrets Scanning tools.
• Experience with AWS, Azure, and GCP cloud security, including IAM, networking, storage, compute, Kubernetes, and container security.
  Good understanding of Secure SDLC, DevSecOps, CI/CD pipelines, and modern application architectures.
• Strong knowledge of networking fundamentals, TCP/IP, HTTP/HTTPS, TLS, authentication,authorization, OAuth2, JWT, and API security.
• Good scripting and automation skills using Python, Bash, PowerShell, or similar languages.
• Strong analytical, problem-solving, reporting, and communication skills.
• Ability to work independently, prioritize multiple assignments, and manage competing deadlines.
• OSCP, OSWE, CEH, AWS Security Specialty, or equivalent security certifications are preferred.
• Proficient in open-source security tools and technologies.
• Willingness to work in a 24x7 support environment and take on additional responsibilities