Security Engineer

Dezerv; Bengaluru; Presencial; INR 1.800.000 - 3.600.000; Jornada completa

Descripción de la vacante

Dezerv in Bengaluru seeks a Security Engineer to strengthen application and cloud security across web and mobile platforms. You will lead testing and collaborate with product and engineering to fix flaws before deployment.

You will also drive regulatory alignment with SEBI CSCRF and ISO 27001, and contribute to shaping secure architecture patterns for our wealth-tech platform.

Formación

• 3 to 5 years of hands-on experience in Application Security, Pen Testing, and Cloud Security.
• Deep knowledge of OWASP Top 10, web/mobile vulnerabilities, API security testing.
• Experience with AWS, Docker, and Kubernetes/EKS; scripting in Python/Go/Bash.

Responsabilidades

• Lead manual and automated penetration testing across web and mobile apps.
• Harden and audit AWS cloud, Docker containers, and Kubernetes clusters.
• Integrate security gates into CI/CD pipelines using Python, Go, or Bash.
• Conduct threat modeling (STRIDE) with design teams to establish secure patterns.
• Own the vulnerability lifecycle from discovery to remediation; participate in incident response rotation.
• Ensure compliance with SEBI CSCRF and ISO 27001 guidelines.

Conocimientos

Application Security

Penetration Testing

Cloud Security

Herramientas

Burp Suite Pro

OWASP ZAP

Postman

MobSF

Descripción del empleo

Dezerv is a house of investing solutions for India's high-net-worth and affluent families, co-founded by Sandeep Jethwani, Vaibhav Porwal, and Sahil Contractor — who between them have run over USD 7 billion in assets across JP Morgan, UBS, and BNP Paribas. We're backed by Premji Invest, Accel, Elevation, and Matrix, and our clients have trusted us with over ₹18,000 crore of their wealth.

Investing is stressful. Building wealth is slow and unforgiving. We're building the platform that fixes that — deep investment expertise, paired with technology, minus the cost and anxiety of a traditional advisory relationship. We've grown fast because we're genuinely good at this, transparent on fees, and modern in how we build.

What are we trying to solve/mission?

We are passionate about helping Indians invest better. We manage investments with active oversight to help both sophisticated and new investors build long-term wealth across various market conditions.

What You Will Do

• Application & Mobile Security: Lead manual and automated penetration testing (SAST/DAST/IAST) across our Web and Mobile applications. Identify business-logic flaws beyond standard automated scanner findings.
• Cloud & Container Security: Harden and audit our AWS cloud infrastructure, Docker containers, and Kubernetes (K8s) clusters. Build real-time posture management (CSPM) and container security controls.
• DevSecOps & Automation: Integrate automated security gates (dependency scanning, secret detection, code analysis) directly into CI/CD pipelines using Python, Go, or Bash.
• Threat Modeling & Shift-Left: Partner directly with Product and Engineering teams during design phases to conduct threat modeling (STRIDE) and establish secure architecture patterns before code is written.
• Vulnerability Management & Incident Response: Own the vulnerability lifecycle—from discovery and triage to remediation tracking. Participate in the security incident response rotation and lead post-incident reviews.
• Regulatory & Compliance Alignment: Work closely with the Lead to ensure our application and cloud controls align with SEBI CSCRF (Cyber Security and Cyber Resilience Framework) guidelines and ISO 27001 standard requirements.
• Security Culture: Conduct targeted security awareness workshops and secure coding sessions for engineering and product teams.

What We Are Looking For:

Required Qualifications:

• 3 to 5 years of hands-on experience in Application Security, Penetration Testing, and Cloud Security.
• Core AppSec Expertise: Deep knowledge of OWASP Top 10 (Web & Mobile), business logic vulnerabilities, API security testing, and hands-on proficiency with tools like Burp Suite Pro, OWASP ZAP, Postman, and MobSF.
• Cloud & Infra Security: Demonstrated experience securing AWS environments and containerized workloads (Docker, Kubernetes/EKS).
• Scripting & Automation: Proficiency in Python, Go, or Bash to automate security workflows, parse tool outputs, or build custom security scripts.
• Threat Modeling: Hands-on experience mapping threat models for complex web/mobile financial architectures.

Nice to Have / Bonus:

• Fintech Experience: Prior experience working in a regulated Fintech or WealthTech environment in India.
• Regulatory Knowledge: Familiarity with SEBI CSCRF, RBI cybersecurity guidelines, or ISO 27001.
• Certifications: Offensive Security certifications like OSCP, or cloud security credentials (AWS Certified Security - Specialty). (Note: Hands-on skills beat certifications).
• High Impact & Ownership: As a key member of a 4-person security team, your work directly safeguards billions in asset management. No red tape, no endless approvals—you spot a flaw, you fix or drive remediation.
• Full-Stack Exposure: You won't be siloed into just AppSec or Cloud. You will sharpen your skills across web, mobile, K8s, AWS, automation, and regulatory frameworks.
• Direct Path to Leadership: Opportunity to grow into a Security Leader within one of India's fastest-growing wealth-tech companies.