Job Description

Location: Pune (Hybrid)

Experience: 5+ years (about 70% software development, 30% security)

About the role

This is a development-first security role. About 70% of the work is engineering: you will fix vulnerabilities in application code, upgrade vulnerable components, and build the tooling and automation that keep issues from coming back. The other 30% is security testing across our web apps and APIs. You own each fix end to end, from the finding to a merged, tested change.

What you will do

Development and remediation

Fix vulnerabilities directly in application code, in whatever language or framework the application uses, and add tests that prove the fix.
Fix root causes, not single instances: build shared validation, output encoding, parameterized queries, and authorization checks that remove whole classes of vulnerabilities.
Upgrade vulnerable libraries, frameworks, and third-party components, resolve breaking changes, and keep builds and tests passing.
Build internal security tooling and automation: scanner integrations, triage and reporting scripts, and checks that catch issues before release.
Integrate SAST, DAST, and SCA tooling such as Aikido into CI/CD pipelines, and tune the rules to cut noise.
Fix infrastructure and configuration issues: web server and TLS settings, cloud IAM and network rules, container and Kubernetes configuration, infrastructure-as-code, and CI/CD pipeline hardening.
Where code or infrastructure is owned by another team, raise the change yourself as a pull request and drive it to merge.

Security testing

Test web applications and APIs for exploitable vulnerabilities.
Review code and design for flaws in authentication, authorization, session handling, data flows, and secrets management.
Run and tune vulnerability scans across applications, hosts, or cloud accounts, and prioritize findings by exploitability and business impact alongside CVSS.
Retest fixes and close findings only when the vulnerability is confirmed resolved.

Reporting and communication

Write clear findings and fix notes with reproduction steps, evidence, risk rating, and the change made.
Agree on realistic remediation timelines with engineers, and share secure coding patterns so the same issues stop recurring.

What you bring

Experience

5+ years total: approx. 3.5 years building and shipping production software as a developer, and approx. 1.5+ years of hands-on security work such as VAPT, application security, or secure code review.
A track record of fixing security issues in code.

Development expertise

Production-level depth in at least two of: Java, C#/.NET, JavaScript/TypeScript, Python, PHP, Go, Swift, or Kotlin. Comfortable reading and changing code in languages you know less well.
Able to land a correct, tested fix in an unfamiliar codebase without breaking existing behavior.
Web and API development: REST and GraphQL services; authentication with OAuth 2.0, OpenID Connect, and JWT; session management; databases and ORMs.
Unit and integration testing, Git-based workflows, pull requests, and code review.
CI/CD pipelines, Docker, Kubernetes, and infrastructure-as-code such as Terraform or CloudFormation.
Working knowledge of Nginx, Apache, IIS, and TLS configuration.
Scripting in Python, Bash, or PowerShell to automate testing and remediation.

Communication

Clear written findings and the ability to explain risk and trade-offs to engineers and business stakeholders.

Nice to have

Web and API: manual testing with Burp Suite Professional; OWASP Top 10 and ASVS; injection, authentication and session flaws, access control (IDOR/BOLA), SSRF, and OAuth and JWT weaknesses.
Secure code review: spotting vulnerable patterns in code and using SAST and SCA results to find and fix real issues.
Built security tools, Burp extensions, or custom SAST rules (for example, Semgrep or CodeQL).
Threat modeling and secure design review experience.
Familiarity with compliance evidence requirements (ISO 27001, SOC 2, PCI DSS) as they relate to vulnerability remediation.

What success looks like

Vulnerabilities reach merged, tested fixes within agreed timelines.
Recurring vulnerability classes decline because fixes address root causes.
The tooling and automation you build catch issues before release and cut manual triage.
Development teams see you as a fellow engineer who ships fixes alongside them.
Cloud misconfiguration and patch exposure windows stay short.