Principal Security Engineer

EduRankAI; Kolkata District; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

EduRankAI in Kolkata, India, is seeking a seasoned security leader to own the company’s application and platform security posture. You will head a small security team and be the accountable engineer for defense decisions across applications, infrastructure, and data privacy.

You will drive the secure-SDLC program, oversee GDPR/DPDPA 2023 technical controls, and manage incident response, threat modeling, and third-party testing.

Qualifications

• 10+ years of application and platform security experience.
• Cloud security across AWS, GCP, and related platforms.
• Fundamental cryptography knowledge.
• Experience running a Secure-SDLC programme.
• Familiarity with threats to LLMs (prompt injection, jailbreaks, data exfil).
• Strong written communicator with ability to document security posture clearly.

Responsibilities

• Own the threat model and the security architecture document.
• Lead incident response — commander, on the page, in the postmortem.
• Run the secure-SDLC programme (code review, scanning, audits, training).
• Own GDPR + DPDPA 2023 technical compliance — the actual controls, not the policy PDFs.
• Run the bug bounty and responsible disclosure programme.
• Commission quarterly third-party penetration tests; own the remediation.

Skills

Security Leadership

Threat Modeling

Incident Response

Secure SDLC

LLM Threats

Cloud Security

Cryptography

Written Communication

Job description

Application & Platform Security

Own EduRankAI's security posture: application security, infra security, data privacy (DPDPA 2023 + GDPR). You will lead a small security team and you will be the engineer accountable when something goes wrong.This role exists because AI companies face a more interesting threat surface than most: prompt injection, training-data exfil, model jailbreaks, plus the usual application security. You will own the whole picture, and you will write enough code to defend the design choices you make.

Responsibilities

• Own the threat model and the security architecture document.
• Lead incident response — commander, on the page, in the postmortem.
• Run the secure-SDLC programme (code review, scanning, audits, training).
• Own GDPR + DPDPA 2023 technical compliance — the actual controls, not the policy PDFs.
• Run the bug bounty and responsible disclosure programme.
• Commission quarterly third-party penetration tests; own the remediation.

Skills

• 10+ years application + platform security
• Cloud security (AWS / GCP / Vercel)
• Cryptography fundamentals
• Secure-SDLC programme experience
• Familiarity with LLM-specific threats (prompt injection, jailbreaks, data exfil)
• Strong written communicator