About Angel One:

Angel One is one of India's fastest growing fin-techs, on a bold mission to make investing simple, smart, and inclusive for every Indian. With over 3+ crore clients, we're building at scale – and building for impact.

Our Super App helps clients manage their investments, trade seamlessly, and access financial tools tailored to their goals. We are working to build personalized financial journeys for our clients, powered by new-age tech, AI, Machine Learning and Data Science.

We're a builder's company at heart. You'll have the space to experiment, the freedom to move with velocity, and the mandate to make bold, user-first decisions – every single day.

The vibe Think less hierarchy, more momentum. Everyone has a seat at the table and a shot to build something that lasts.

Be part of a team that's scaling sustainably, thinking big, and building for the next billion.

Why You'll Love Working at Angel One!

Tech Systems that run at Scale: From AI to real-time data infra, you'll work on tech that's ahead of the curve and solve problems that truly matter.
Build one of India's Leading Fintech Platform: We're not just disrupting finance – we're shaping how billion Indians access wealth.
Own It. Drive It. Scale It: You'll have the freedom to lead, the resources to build, and the opportunity to leave your mark.
Empowered Growth: We invest in your growth and empower you to explore your full potential.
Exceptional Benefits: Our comprehensive benefits package includes health insurance, wellness programs, learning & development opportunities, and more.

Lead Security Engineer – Security Assurance (Cloud & Offensive Security)

Location: Bengaluru / Mumbai

Department: Information Security – Security Assurance

Reports To: Security Manager / Senior Director – Security Assurance

About the Role

Angel One is looking for an experienced Senior Security Engineer – Security Assurance to strengthen its offensive security capabilities across cloud, applications, infrastructure, APIs, Kubernetes, and enterprise environments.

This is a highly technical, hands-on role focused on Vulnerability Assessment and Penetration Testing (VAPT), cloud exploitation, adversary emulation, and security validation. The successful candidate will go beyond identifying vulnerabilities—they will demonstrate exploitability, assess business impact, and provide actionable remediation guidance to engineering teams.

The ideal candidate should have deep expertise in offensive security techniques across AWS, GCP, or Azure, with a strong understanding of modern cloud-native architectures, containerized workloads, identity systems, and CI/CD pipelines. They should be capable of conducting manual penetration testing, chaining vulnerabilities, and simulating realistic attack scenarios.

Key Responsibilities

1. Vulnerability Assessment & Penetration Testing (Primary Responsibility)

Plan and execute end-to-end VAPT engagements across Angel One's technology landscape, including:

Web applications
Mobile applications (Android & iOS)
APIs (REST, GraphQL, gRPC)
Internal and external infrastructure
Cloud environments
Containers and Kubernetes
Perform both automated and manual testing to identify vulnerabilities, validate findings, and assess real-world exploitability.

2. Cloud Offensive Security (Primary Responsibility)

Conduct offensive security assessments across AWS, Azure, and GCP environments.

Identify and exploit cloud-specific weaknesses, including:

IAM privilege escalation
Misconfigured storage services
Over-permissive roles and policies
Serverless function vulnerabilities
Metadata service abuse
Kubernetes RBAC weaknesses
Container escape scenarios
Secrets exposure
Insecure CI/CD pipelines
Cross-account trust issues
Publicly exposed cloud services
Network segmentation bypass
Identity federation weaknesses
Validate the business impact of cloud misconfigurations through controlled exploitation.

3. Manual Penetration Testing

Perform advanced manual testing to identify vulnerabilities not detected by automated tools, including:

Authentication and authorization flaws
Business logic vulnerabilities
Chained attack paths
Insecure object references
API abuse
SSRF
RCE
XXE
Deserialization attacks
OAuth/OIDC implementation issues
JWT weaknesses
Cloud-native attack paths
Demonstrate proof-of-concept exploits while adhering to established safety and change-management procedures.

4. Adversary Simulation & Exploitation

Conduct controlled adversary simulations to evaluate the effectiveness of preventive and detective controls.

Execute:

Privilege escalation
Lateral movement
Credential attacks
Cloud identity attacks
Attack-path validation
Défense evasion techniques (where authorized)
Attack chain simulations
Map findings to the MITRE ATT&CK framework and provide recommendations to strengthen detection and response capabilities.

5. Container & Kubernetes Security Testing

Assess the security of containerized environments by evaluating:

Kubernetes API exposure
RBAC configurations
Admission controller policies
Network policies
Secrets management
Image security
Pod Security Standards
Container runtime configurations
Service account permissions
Validate container escape and privilege escalation scenarios in authorized environments

.

6. Application Security Assessments

Perform in-depth security assessments of applications throughout the SDLC, including:

Source-assisted testing (when applicable)
API testing
Authentication flows
Authorization controls
Session management
Input validation
Encryption implementations
Secure coding practices
Collaborate with developers to explain findings and recommend secure remediation strategies.

7. Vulnerability Validation

Review findings from SAST, DAST, SCA, cloud security tools, and infrastructure scanners.

Validate:

True positives
Exploitability
Business impact
Severity
Remediation effectiveness
Reduce false positives and ensure consistent risk ratings

Required Technical Skills

Mandatory

Strong expertise in manual penetration testing
Hands-on experience with cloud exploitation (AWS, Azure, and/or GCP)
Deep understanding of web application and API security
Experience with container and Kubernetes security testing
Ability to validate exploitability beyond automated scanner findings
Strong knowledge of authentication and authorization mechanisms
Familiarity with attack-path analysis and offensive security methodologies
Experience testing for: OWASP Top 10, OWASP API Security Top 10
Experience with scripting in Python, Bash, or PowerShell to automate assessments is highly desirable.

Experience

7–10 years of experience in Information Security
Minimum 4 years focused on penetration testing and offensive security
Experience testing cloud-native applications and infrastructure
Experience conducting manual exploitation beyond automated scanning
Experience working with cloud engineering and DevSecOps teams
Experience in financial services, fintech, or regulated environments is preferred

Qualifications

Bachelor's degree in Computer Science, Engineering, Information Security, or a related discipline.

Preferred certifications:

OSCP (Highly Preferred)
OSWE
OSEP
CRTO
PNPT
CARTP / CARTE
AWS Certified Security – Specialty
Google Professional Cloud Security Engineer
Microsoft Certified: Azure Security Engineer Associate
Burp Suite Certified Practitioner
eCPPT

What Makes an Ideal Candidate

The ideal candidate is a technically accomplished offensive security professional who enjoys understanding how complex systems can be compromised—and using that knowledge to make them more secure. They are comfortable exploiting vulnerabilities in cloud-native environments, validating business impact, and partnering with engineering teams to eliminate risk. Beyond running tools, they understand modern architectures, think like an attacker, and can adapt to evolving technologies while maintaining the rigor expected in a regulated financial services environment.

Senior Application Security Engineer