Lead Security Engineer – Vulnerability Management

Staples India; Chennai; On-site; INR 4,500,000 - 7,000,000; Full time

Job summary

Staples India is seeking a Lead Security Engineer to own vulnerability management and drive maturity initiatives across Staples environments. You will partner with cybersecurity, infrastructure, and application teams to evolve a risk-based program and mentor engineers.

You will design automation, AI-assisted workflows, and offensive security capabilities, including internal testing and bug bounty programs, while reporting progress to senior leadership.

Qualifications

• 8+ years of hands-on cybersecurity experience in vulnerability management and security automation.
• Experience leading projects or mentoring others.
• Strong knowledge of CVSS, EPSS, CISA KEV, and exploit maturity.
• Hands-on security testing: web/API, DAST, SAST, and red/purple teaming.
• Python or a similar language for automation and data analysis.

Responsibilities

• Serve as technical lead for vulnerability management program direction and prioritization.
• Own end-to-end delivery of maturity projects from approach to reporting.
• Design automation and AI-assisted workflows for triage, enrichment, and reporting.
• Build offensive security capabilities including internal and purple-team testing.
• Evaluate and onboard new security capabilities with PoCs and recommendations.
• Define runbooks and coach engineers to scale processes.
• Support PCI DSS, SOC 2, and audit requests with evidence and remediation status.
• Report program health to senior leaders with dashboards tied to business risk.

Skills

Vulnerability management

Offensive security

Application security

Security automation

Risk-based prioritization

Automation & AI triage

Mentoring engineers

Python

PowerShell

Bash

REST APIs

Git

Power BI

LLM frameworks

Tools

Qualys

NoName API Security

Seemplicity UVM/UEM

FIM

ServiceNow

CheckmarxOne

Orca Security

GitHub

EASM

CSPM

Rapid7 DAST

Job description

Staples India Business Innovation Hub Private Limited | Permanent

Lead Security Engineer – Vulnerability Management

This role is designed for a lead cybersecurity engineer with approximately 8+ years of experience in vulnerability management, exposure management, offensive security, application security, and security automation. The position serves as a technical lead and subject-matter expert for the vulnerability management function, helping shape the roadmap and owning delivery of maturity initiatives from approach through measurable outcomes. The Lead Security Engineer will partner with cybersecurity, infrastructure, application, and platform teams to evolve vulnerability management into a proactive, risk-based program. The role brings depth in areas such as risk-based prioritization, automation and AI-assisted triage, application security, vulnerability disclosure, and offensive security, and mentors engineers to scale proven practices.

Duties & Responsibilities

• Serve as technical lead and subject-matter expert for vulnerability management, advising on program direction, tooling, and prioritization across Staples environments.
• Own end-to-end delivery of vulnerability management maturity projects, from defining the approach and success measures through implementation, adoption, and reporting.
• Design and build automation and AI-assisted workflows for triage, enrichment, ticketing, and reporting that reduce manual effort and improve time to remediation.
• Build and mature offensive security capabilities, including internal penetration testing, segmentation testing, purple-team exercises, and vulnerability disclosure and bug bounty programs.
• Evaluate and onboard new security capabilities, running proofs of concept and recommending adopt, extend, or retire decisions.
• Define runbooks, quality standards, and handoff practices for operational work, and coach engineers as proven processes are scaled across teams.
• Support PCI DSS, SOC 2, customer audit requests, and other compliance activities by providing accurate vulnerability evidence and remediation status.
• Report program health to senior leaders through dashboards and metrics that tie vulnerability data to business risk.

Technologies:

• Qualys, NoName API Security, Seemplicity UVM/UEM, FIM, ServiceNow, CheckmarxOne, Orca Security, GitHub, EASM, CSPM, Rapid7 DAST
• Vulnerability management, exposure management, DAST, API security, SAST, SCA, CSPM, IoT/OT security, threat intelligence, penetration testing, purple teaming
• Python, PowerShell, Bash, REST APIs, Git, Power BI, LLM and AI-agent frameworks, ServiceNow workflows

Requirements

Minimum of 8+ years of hands-on cybersecurity experience, including significant depth in vulnerability management, offensive security or application security testing, and security automation, with experience leading projects or mentoring others.

Basic Qualifications

• Expert-level experience with vulnerability management platforms, scanning, and the full lifecycle from detection and prioritization to remediation and verification.
• Strong understanding of risk-based prioritization models and signals such as CVSS, EPSS, CISA KEV, and exploit maturity.
• Hands-on experience with offensive security techniques, such as penetration testing, web and API testing, or red/purple teaming, and with DAST or application security tooling.
• Proficiency in Python or a comparable language for automation, API integrations, and data analysis, plus familiarity with applying LLMs to security workflows.
• Proven ability to lead projects, document processes clearly, and mentor engineers.

Preferred Qualifications

• Relevant certifications such as OSCP, GPEN, GWAPT, CISSP, or equivalent offensive and security certifications.
• Experience with ServiceNow, Seemplicity, or similar remediation workflow and exposure-management platforms, with defined SLAs and ownership tracking.
• Experience building or running vulnerability disclosure or bug bounty programs, IoT/OT security assessments, or threat-intelligence pipelines is preferred.