Principal Security Engineer

Porch Group; India; Hybrid; INR 4,000,000 - 7,000,000; Full time

Job summary

Porch Group is hiring a Principal Security Engineer to safeguard digital assets, design secure cloud workloads, and lead the security architecture across AWS/Azure/GCP, networks, identities, and data. You will guide threat modeling, incident response, and compliance with SOC 2, ISO 27001, PCI DSS, GDPR, and India DPDP, while mentoring the India-based security team.

You will define secure SDLC practices, implement SIEM strategies, and drive build-vs-buy decisions for security tooling in a

Qualifications

• 10+ years in information security, with 5+ years in a security architecture or senior security engineering role.
• 3+ years leading technical teams, including mentoring senior engineers.
• Incident response experience as technical lead on high-severity incidents, including scoping, containment, and postmortem ownership.
• Hands-on penetration testing experience — web, API, and cloud pen tests with reports.
• Fluency in AI security, practical understanding of LLM/agentic threat models, guardrails, and AI red teaming.
• Strong app security depth: secure code review, OWASP Top 10, API Security Top 10, threat modeling and SDLC integration.
• Deep hands-on expertise in at least one major cloud platform, plus container/Kubernetes security and IaC.
• Hands-on experience with SIEM and security operations, including data onboarding and query authoring.
• Demonstrated ownership of enterprise-scale identity, network segmentation, or data protection architecture.
• Working fluency with at least two compliance frameworks and audit-ready controls.
• Scripting/automation capability (Python, Go) to build tooling and validate controls.

Responsibilities

• Define and maintain reference architectures, security patterns, and design standards for cloud, application, network, identity, and data layers.
• Lead threat modeling for new products and infrastructure changes; translate findings into prioritized engineering work.
• Serve as security design authority in architecture reviews and document accepted risk with owners and expiry dates.
• Design identity and access architecture: SSO/SAML/OIDC, privileged access, service-to-service authentication, secrets management, least-privilege models.
• Own the SIEM and security data platform architecture: data onboarding, pipelines, retention, cost discipline.
• Lead high-severity incident investigations: containment, root cause analysis, postmortems, systemic fixes.
• Architect data protection: encryption, key management, tokenization, data residency requirements.
• Define secure SDLC architecture: SAST/DAST/SCA, IaC scanning, policy-as-code enforcement.
• Establish detection/response architecture: logging standards, telemetry, alerting for new systems.
• Evaluate security tooling; perform PoCs and build case for build-vs-buy decisions.
• Map architecture to compliance obligations (SOC 2, ISO 27001, PCI DSS, GDPR, India DPDP) and design cross-framework controls.
• Maintain security architecture roadmap and technical debt register; sequence remediation by business risk.
• Provide day-to-day technical leadership for India-based security team.

Skills

Threat modeling

Incident response

Cloud security

Scripting Python/Go

Identity & access management

AI security awareness

OWASP Top 10

Kubernetes security

SIEM

Data protection

Policy enforcement

Tools

AWS

Azure

GCP

Kubernetes

SIEM

Terraform / IaC

Job description

Porch Group is a leading vertical software and insurance platform and is positioned to be the best partner to help homebuyers move, maintain, and fully protect their homes. The Principal Security Engineer plays a critical role in safeguarding Porch's digital assets and reputation against security breaches, cyber-attacks, and unauthorized access. Their primary responsibility is to ensure the integrity, confidentiality, and availability of Porch information systems. As a Principal Security Engineer, you will be responsible for designing, implementing, and maintaining security measures to protect Porch's cloud workloads, identities, networks, and data. You will analyze potential security threats, develop strategies to mitigate risks, and respond to security incidents. You will also provide technical leadership to the security team and collaborate with cross-functional teams to ensure compliance with Porch's security policy and compliance requirements.

Responsibilities

• Define and maintain reference architectures, security patterns, and design standards for cloud (AWS/Azure/GCP), application, network, identity, and data layers.
• Lead threat modeling for new products, major features, and infrastructure changes; translate findings into prioritized, actionable engineering work.
• Serve as security design authority in architecture reviews — approve, reject, or condition designs, and document accepted risk with clear owners and expiry dates.
• Design identity and access architecture: SSO/SAML/OIDC, privileged access, service-to-service authentication, secrets management, and least-privilege models.
• Own the architecture of the SIEM and security data platform — log source onboarding, data pipeline and normalization, schema/data model standards, retention tiers, and cost-per-GB discipline.
• Serve as senior technical escalation for high‑severity and significant incidents: lead investigation, scope compromise, direct containment, lead root cause analysis on architectural failures, and own the technical postmortem and systemic fixes.
• Architect data protection controls — encryption at rest and in transit, key management, tokenization, classification‑driven handling, and data residency requirements.
• Define secure SDLC architecture: SAST/DAST/SCA integration, IaC scanning, pipeline guardrails, and policy‑as‑code enforcement.
• Establish detection and response architecture requirements — logging standards, telemetry coverage, SIEM data model, and alerting expectations for new systems.
• Evaluate and select security tooling; run proofs of concept, define success criteria, and own the technical case for build‑vs‑buy decisions.
• Map architecture to compliance obligations (SOC 2, ISO 27001, PCI DSS, GDPR, India DPDP Act) and design controls that satisfy multiple frameworks with one implementation.
• Maintain the security architecture roadmap and technical debt register; sequence remediation against business risk rather than tool findings.
• Provide day to day technical leadership for the India‑based security team.

Requirements

• 10+ years in information security, with 5+ years in a security architecture or senior security engineering role.
• 3+ years leading technical teams (formal or matrixed), including mentoring senior engineers.
• Incident response experience as technical lead on high‑severity incidents, including scoping, containment, and postmortem ownership.
• Demonstrated hands‑on penetration testing experience — you have personally scoped and executed web, API, and cloud pen tests and written the reports, not just managed vendors.
• Fluency in AI security — practical, current understanding of LLM and agentic system threat models, guardrail design, and AI red teaming, backed by real work rather than reading.
• Strong application security depth: secure code review, OWASP Top 10 and API Security Top 10, threat modeling, and secure SDLC integration.
• Deep hands‑on expertise in at least one major cloud platform, plus container/Kubernetes security and infrastructure‑as‑code.
• Hands‑on experience with SIEM and security operations, including data onboarding, parsing, and query authoring, not just dashboard consumption.
• Demonstrated ownership of enterprise‑scale identity, network segmentation, or data protection architecture.
• Working fluency with at least two compliance frameworks and experience designing controls that hold up under audit.
• Scripting/automation capability (Python, Go, or equivalent) sufficient to build tooling, write exploits, and validate controls independently.
• Track record of influencing engineering teams without direct authority; strong written communication for design docs, risk narratives, and pen test reports.

Preferred

• Preferred: Experience using AI to facilitate penetration testing — LLM assisted recon, payload generation, finding triage, or agentic offensive tooling.
• Preferred: Offensive security certifications: OSCP, OSWE, OSEP, GPEN, GWAPT, or equivalent demonstrated capability.
• Preferred: Architecture certifications: CISSP, CCSP, SABSA, or cloud‑specific architect credentials.
• Preferred: AI security credentials or contributions — OWASP LLM Top 10 involvement, published AI red team research, CTF or bug bounty results against AI systems.
• Preferred: Experience in a distributed, multi-region organization with a significant India engineering presence.
• Preferred: Background in threat modeling methodologies (STRIDE, PASTA) and zero‑trust architecture implementation.
• Preferred: Proven experience working with US based business teams.
• Preferred: Ability to work within core US business hours / time zone expectations - Eastern Standard Time (EST) overlap.