IT Security Engineer

Fastenal; Bengaluru; On-site; INR 1,200,000 - 1,900,000; Full time

Job summary

Fastenal is seeking an IT Security Engineer in Bengaluru to design, test, and implement security controls in line with corporate policies. The role involves VAPT for web and mobile apps, SAST and SCA, and close collaboration with SOC for incident response.

The ideal candidate has 5+ years in information security, with at least 3 years in VAPT, and hands-on experience with industry tools and cloud security practices. On-site role with on-call rotations.

Qualifications

• Degree in IT/Computer Science
• At least 5 years of information security experience
• At least 3 years of VAPT experience
• Strong problem solving and communication skills
• Self-motivated and able to work independently or in a team
• Demonstrates core values of ambition, integrity and teamwork

Responsibilities

• Perform VAPT for Web and Mobile apps.
• Conduct SAST using source-code scanning tools.
• Perform SCA to identify vulnerable libraries.
• Validate remediations via manual testing and rescans.
• Correlate findings across security tools for risk assessment.
• Assess tooling effectiveness and suggest improvements to security programs.
• Track vulnerabilities to ensure timely remediation.
• Support SOC for security operations and incident response.
• Design, implement and monitor security controls for systems and data.
• Maintain long-term storage of security-relevant data.

Skills

VAPT

Web security

SAST

SCA

Threat remediation

Communication

Teamwork

Education

B.Tech/B.E. in IT/CS

Tools

INVICITI

BurpSuite

Coverity

SonarQube

Github CodeQL

Corellium

Azure Cloud Security

WAF

Tenable

RiskSense

Job description

Business Unit Overview:

Working as Full-Time IT Security Engineer you will be responsible for testing, designing and implementing security controls and solutions driven by policies and standards to reduce the risk to Fastenal and its customers.

Responsibilities:

The duties and responsibilities of this position include, but are not limited to:

• Performing Vulnerability Assessment and Penetration Testing (VAPT) for Web and Mobile applications
• Perform Static Application Security Testing (SAST) using source-code security scanning tools.
• Perform Software Composition Analysis (SCA) to identify vulnerable, outdated, or unsupported third-party libraries and dependencies.
• Validate security remediation through manual testing, automated rescans.
• Review and correlate application security findings across multiple security tools and ensure appropriate risk assessment, prioritization, and remediation.
• Assess application security tooling effectiveness, identify coverage gaps, and recommend improvements to the Application Security / Product Security program.
• Track application security vulnerabilities through remediation and ensure identified issues are addressed within defined timelines.
• Assisting SOC team for Security Operations and Incident Response
• Engineering, implementing and monitoring security measures for the protection of computer systems, networks, and information
• Engineering, implementing, and monitoring long-term retention of security relevant data collection and storage
• Monitoring security analytics and investigating anomalies
• Configuring and troubleshooting security infrastructure software and devices
• Designing, implementing and maintaining controls around sensitive data (PCI, SOX, HIPAA, etc)
• Providing 12x7 support on critical systems in an on-call rotation

RequiredPosition Qualifications:

The following skills and qualifications are required for this position:

• Possess a degree in Information Technology, Computer Science and have at least 5 years of relevant experience in the areas of information security
• Having at least 3 years of relevant experience in Vulnerability Assessment and Penetration Testing (VAPT)
• Demonstrated knowledge of problem solving, planning, and continuous improvement methods
• Excellent written and oral communication skills
• Highly motivated, self-directed and customer service oriented
• Demonstrate strong math aptitude, attention to detail and sense of urgency
• Work independently as well as in a team environment
• Demonstrate our core values of ambition, innovation, integrity and teamwork

Preferred Position Qualifications:

• Certification as OSCP, CompTIA Pentest+, GWAPT, BSCP, CEH, OSWE
• Handson experience with INVICTI, BurpSuite, Coverity, SonarQube, Github CodeQL, Corellium, Microsoft Azure Cloud Security, Web Application Firewall (WAF), Tenable and RiskSense
• Prior experience in the development and delivery of information security concepts to technical and non-technical partners through training and awareness programs
• Knowledge of data protection policies, procedures and products (Privacy rules and regulations, data security, encryption, digital rights management, Data Loss Prevention)