Lead/Senior Security System Engineer

EPAM Systems; India; On-site; INR 4,000,000 - 6,000,000; Full time

Job summary

EPAM Systems is looking for a Lead/Senior Security System Engineer to head vulnerability triage, analysis, remediation guidance and reusable fix patterns across apps, cloud environments, and the software supply chain.

You will collaborate with product and development teams to strengthen secure engineering practices, drive DevSecOps transformation initiatives, and reduce security exposure across a large-scale portfolio.

Qualifications

• Experience leading vulnerability triage, remediation guidance and secure coding reviews.
• Strong track record implementing DevSecOps and secure SDLC across large portfolios.
• Expertise with SAST/DAST tools and cloud security practices.
• Ability to develop reusable fix patterns and remediation playbooks.
• Proven ability to guide engineering teams and communicate complex findings.
• Experience with checkmarx/codeql/wiz/jfrog xray workflows and governance.

Responsibilities

• Lead triage, validation and prioritization of security vulnerabilities.
• Analyze findings from Checkmarx, CodeQL, Wiz and JFrog Xray.
• Direct investigation of application code, cloud config, IAM and dependencies.
• Develop proof-of-concept fixes and actionable remediation guidance.
• Perform secure-code reviews and provide recommendations to developers.
• Create remediation playbooks, runbooks and technical guidance.
• Support root-cause analysis for recurring vulnerabilities and trends.
• Guide teams to improve secure engineering practices and DevSecOps controls.
• Support vulnerability reduction planning and risk reporting.

Skills

Vulnerability management

DevSecOps

Cloud security

Secure SDLC

Leadership

Threat modeling

Technical governance

Tools

Checkmarx

CodeQL

Wiz

JFrog Xray

GitHub Actions

Azure DevOps

Job description

We are seeking a Lead/Senior Security System Engineer to lead vulnerability triage, technical analysis, remediation guidance, and the development of reusable fix patterns across applications, cloud environments, and the software supply chain. This role involves close collaboration with product and development teams to strengthen secure engineering practices, drive DevSecOps transformation initiatives, and reduce security exposure across a large-scale portfolio.

Responsibilities

• Lead technical triage, validation and prioritization of security vulnerabilities
• Analyze findings from Checkmarx, CodeQL, Wiz and JFrog Xray
• Direct investigation of application-code, cloud-configuration, IAM, dependency and software supply-chain vulnerabilities
• Develop proof-of-concept fixes, remediation guidance and reusable fix patterns
• Perform secure-code reviews and provide actionable recommendations to development teams
• Create remediation playbooks, runbooks and technical guidance
• Support root-cause analysis for recurring or complex vulnerabilities
• Review engineering outputs and provide technical guidance to Senior Security Engineers
• Partner with product/development teams to improve secure engineering practices and reduce recurring findings
• Support vulnerability reduction planning, prioritized backlogs, risk reporting and recurring trend analysis
• Guide GitHub repository migration, GitHub Actions and Azure DevOps pipeline migration, and related runners, secrets, permissions and deployment integrations
• Contribute to Checkmarx onboarding, DevSecOps controls, automated quality gates and Golden Pipeline modernization

Requirements

• 6-15 years of overall experience in IT, with a focus on application security, cloud security and software supply-chain security
• Expertise in Checkmarx, CodeQL, SAST/DAST, secure code review and secure SDLC practices
• Proficiency in AWS, Wiz, IAM and cloud configuration security
• Skills in JFrog Xray, dependency analysis, Chainguard and SBOM concepts
• Background in DevSecOps, vulnerability triage, root-cause analysis and remediation pattern development
• Knowledge of security automation and vulnerability management at scale
• Familiarity with GitHub repository migration, GitHub Actions and Azure DevOps pipeline migration
• Understanding of artifact and dependency governance, curation policies and automated policy validation
• Capability to lead technical teams and provide guidance to senior security engineers
• Experience working within large-scale, portfolio-wide security enablement programs