Security Engineer

Humyn Labs; Bengaluru; On-site; INR 1,800,000 - 3,200,000; Full time

Job summary

Humyn Labs seeks an experienced security engineer to run application and architecture security reviews across its products and cloud footprint. You will conduct code/config reviews, perform pen tests, and provide actionable feedback to engineers, shaping secure‑SDLC practices as the company scales.

You will own vulnerability management, threat modeling, and incident response support, with hands-on testing across AWS and Cloudflare.

Qualifications

• 3–7 years in security engineering or application security.
• Strong web and application security fundamentals (OWASP Top 10 in practice).
• Real cloud security depth in AWS and Cloudflare — hands-on with SAST/DAST/VAPT tooling and manual testing.
• Comfort with threat modeling and attacker reasoning.
• Scripting ability (Python or similar) to automate tooling.
• The ability to explain risk clearly to engineers and get fixes shipped — influence without authority.
• Relevant certifications (OSCP, GWAPT, CCSP, or similar).
• Bug bounty, CTF, or independent security research experience.
• Container and Kubernetes security.

Responsibilities

• Run application and architecture security reviews across our products.
• Perform code and configuration reviews, penetration tests, and give engineering teams concrete, actionable feedback.
• Review our cloud security posture across AWS and Cloudflare — configuration, identity, network, and data controls.
• Run and coordinate VAPT — hands‑on testing where it counts, managing external pentests where it makes sense, and triaging findings.
• Guide secure‑SDLC practices — help teams build security in, not bolt it on.
• Own vulnerability management: track, prioritize, and drive remediation to closure.
• Threat‑model new and existing systems to find weaknesses before attackers do.
• Support incident response when something needs investigating.

Skills

Security engineering

Application security

Threat modeling

Cloud security

Python scripting

Risk communication

Bug bounty / security research

CTF participation

Container security

Kubernetes security

Education

OSCP

GWAPT

CCSP

Tools

SAST tooling

DAST tooling

VAPT tooling

Manual pentests

AWS

Cloudflare

Job description

Humyn Labs builds the intelligence layer for physical-world AI. We convert human action — sight, sound, movement, touch — into training-grade multimodal data for embodied AI, captured across 20+ countries in the real environments where physical AI actually deploys, not the labs where it is built.

Our egocentric corpus ships to robotics and world-model teams as labeled data: 6-DoF head pose, metric 3D hand keypoints, depth, object tracks. The labels are the product. Their accuracy is the company.

The role

You'll partner with the Head of Security to run our recurring security audits and reviews — across applications, cloud, and infrastructure. This is a hands-on technical role: you find real risk, explain it clearly to the engineers who can fix it, and make sure it actually gets fixed. You'll have the room to shape how security reviews work here as we scale.

In your first few months

• Get up to speed on our application and cloud architecture and run your first end-to-end security review, from findings to tracked remediation.
• Establish a repeatable cadence for security and architecture reviews rather than one-off checks.
• Build a clear, prioritized view of our current vulnerabilities and drive down the ones that matter most.

What you'll do

• Run application and architecture security reviews across our products.
• Perform code and configuration reviews, penetration tests, and give engineering teams concrete, actionable feedback.
• Review our cloud security posture across AWS and Cloudflare — configuration, identity, network, and data controls.
• Run and coordinate VAPT — hands‑on testing where it counts, managing external pentests where it makes sense, and triaging findings.
• Guide secure‑SDLC practices — help teams build security in, not bolt it on.
• Own vulnerability management: track, prioritize, and drive remediation to closure.
• Threat‑model new and existing systems to find weaknesses before attackers do.
• Support incident response when something needs investigating.

What you bring

• 3–7 years in security engineering or application security. (We're open on level — strong mid‑career and senior candidates are both welcome.)
• Strong web and application security fundamentals (you know the OWASP Top 10 in practice, not just by name).
• Real cloud security depth in AWS and Cloudflare — deep in at least one, comfortable across both. Hands‑on experience with SAST/DAST/VAPT tooling and manual testing — you don't rely on scanners alone.
• Comfort with threat modeling and reasoning about attacker behavior.
• Scripting ability (Python or similar) to automate and build your own tooling.
• The ability to explain risk clearly to engineers and get fixes shipped — influence without authority.
• Relevant certifications (OSCP, GWAPT, CCSP, or similar).
• Bug bounty, CTF, or independent security research experience.
• Container and Kubernetes security.

You'll work directly with the Head of Security on real, high-impact security work with the autonomy to shape how we do reviews as we grow. If you like finding the risk that matters and actually seeing it fixed — not writing reports that gather dust — this is that role.