Lead Security Engineer - AI

EPAM Systems Inc; Pune District; Presencial; INR 3.500.000 - 11.000.000; Jornada completa

Descripción de la vacante

EPAM Systems Inc. is seeking a Lead Security Engineer - AI to create a repeatable penetration-testing program for products and supporting infrastructure. You will define the framework, toolchain, processes, and test environments to assess web apps, APIs, VMs, and cloud configurations across AWS and Azure.

Partner with teams to validate defenses, report risk, drive remediation, and apply today. The role emphasizes building automated testing, integrating security into CI/CD, and staying ahead of

Formación

• 5+ years in penetration testing, application security, offensive security, red teaming, or a comparable role.
• Experience testing web applications, APIs, cloud infrastructure, VMs, operating systems, and network services.
• Strong knowledge of OWASP Top 10, OWASP API Security Top 10, and secure development practices.
• Hands-on experience with major cloud platforms: AWS, Azure, or GCP.
• Deep understanding of IAM, authentication, authorization, session security, networking, and secrets management.
• Proficiency with Burp Suite, Nmap, Wireshark, Metasploit, Nessus/OpenVAS, sqlmap, and cloud-security tools.
• Scripting in Python, Bash, PowerShell, or JavaScript; able to document tests and report findings clearly.

Responsabilidades

• Design and maintain a penetration-testing framework including methodology, scope, and risk tracking.
• Build tools, scripts, environments, and automation for repeatable security assessments.
• Execute manual and automated tests across web apps, APIs, cloud, VMs, networks and OS.
• Identify weaknesses, confirm exploitability, and deliver prioritized remediation guidance.
• Develop attack scenarios reflecting modern attacker behavior and automation.
• Collaborate with engineering, DevOps, cloud, and security teams to remediate findings.
• Integrate security testing into CI/CD pipelines and daily engineering workflows.
• Stay current on vulnerabilities, cloud threats, OWASP guidance, and attack trends.

Conocimientos

Penetration testing

Application security

Red teaming

Cloud security

OWASP Top 10

Python scripting

Communication skills

Herramientas

Burp Suite

Nmap

Wireshark

Metasploit

Nessus/OpenVAS

sqlmap

Cloud-security tools

Descripción del empleo

We are building a Lead Security Engineer - AI role to create a repeatable penetration-testing program for our products and supporting infrastructure. You will define the framework, toolchain, processes, and test environments to assess web apps, APIs, VMs, and cloud configurations across AWS and Microsoft Azure. Partner with teams to validate defenses, report risk, drive remediation, and apply today

Responsibilities

• Design and maintain a penetration-testing framework that defines methodology, scope, cadence, evidence capture, reporting, retesting, and risk tracking
• Build and configure the tools, scripts, environments, and automation needed for repeatable security assessments
• Execute manual and automated penetration testing across web applications, customer-facing portals, APIs, virtual machines, operating systems, networks, and cloud environments (IAM, storage, networking, logging, secrets, containers)
• Identify security weaknesses, confirm exploitability, evaluate business impact, and deliver practical, prioritized remediation guidance
• Develop attack scenarios that mirror modern attacker behavior, including automated reconnaissance, vulnerability discovery, credential attacks, and attack chaining
• Collaborate with software engineering, DevOps, cloud, infrastructure, product, and security teams to explain findings, assist remediation, and verify fixes via retesting
• Integrate security testing and scanning into CI/CD pipelines and day-to-day engineering workflows
• Stay current on vulnerabilities, offensive-security techniques, cloud-security threats, OWASP guidance, and emerging attack trends

Requirements

• Extensive experience with 5+ years in penetration testing, application security, offensive security, red teaming, or a comparable role
• Demonstrated experience testing web applications, APIs, cloud infrastructure, virtual machines, operating systems, and network services
• Strong knowledge of OWASP Top 10, OWASP API Security Top 10, common web and API attack techniques, and secure-development practices
• Practical experience assessing one or more major cloud platforms: AWS, Microsoft Azure, or Google Cloud Platform
• Deep understanding of identity and access management, authentication, authorization, session security, networking, encryption, secrets management, and common cloud misconfigurations
• Hands-on experience with tools such as Burp Suite, Nmap, Wireshark, Metasploit, Nessus/OpenVAS, sqlmap, and cloud-security tools
• Proficiency in scripting or programming using Python, Bash, PowerShell, JavaScript, or similar languages
• Proven ability to independently plan and execute tests, document evidence, communicate risk, and deliver concise, actionable technical reports
• Strong communication skills and the ability to work constructively with engineering and business stakeholders

Nice to have

• Experience creating internal penetration-testing frameworks, labs, tools, scripts, or security-test automation
• Experience embedding security controls or testing activities into CI/CD pipelines
• Knowledge of Docker, Kubernetes, Terraform, infrastructure as code, and container-security testing
• Relevant certifications such as OSCP, OSWE, OSEP, CRTO, CREST, GPEN, GWAPT, PNPT, CISSP, or cloud-security certifications