Security Engineer — Application & Cloud Security

HAMLY BUSINESS SOLUTIONS INDIA PRIVATE LIMITED; Tamil Nadu; Vor Ort; INR 1.200.000 - 2.400.000; Vollzeit

Zusammenfassung

Keka Inc. in Tamil Nadu seeks a Security Engineer to perform web and API security testing across healthcare-related platforms. You will safeguard patient data and internal apps through rigorous assessments.

Responsibilities include OWASP-aligned testing, AWS security hardening, CI/CD integration of SAST/DAST/SCA, and security incident response. Strong scripting in Python or Bash and collaboration with product and engineering teams are essential.

Qualifikationen

• Experience performing web application and API security testing across complex environments.
• Knowledge of OWASP Top 10 and API Security Top 10.
• Ability to review AI-assisted and low-code apps for vulnerabilities.
• Experience with AWS security controls (IAM, VPC, S3, KMS, CloudTrail).
• Experience integrating SAST/DAST/SCA into CI/CD pipelines.
• Scripting in Python or Bash for automation.
• Security incident response and root-cause analysis.
• Ability to communicate risks to technical and non-technical stakeholders.

Aufgaben

• Perform web app and API penetration testing.
• Identify vulnerabilities in authentication, authorization, IDOR, injection, session management.
• Test according to OWASP Top 10 and OWASP API Top 10.
• Conduct multi-tenant security testing, including RBAC and tenant isolation.
• Review AI-assisted and low-code apps for security vulnerabilities.
• Own security review and pre-release security gate.
• Harden AWS infrastructure including IAM, VPC, S3, KMS, security groups, CloudTrail.
• Implement least-privilege access and secrets management.
• Define security logging and monitoring requirements.
• Support security incident investigation and root-cause analysis.
• Coordinate with 24x7 security monitoring provider for alerts and incidents.
• Integrate SAST, DAST, and SCA tools into CI/CD pipelines.
• Tune tools to reduce false positives and improve actionable results.
• Conduct dependency and supply-chain security reviews, including CVE checks.
• Develop Python or Bash scripts to automate security checks.
• Maintain security standards and audit evidence.
• Support PHI, HIPAA, SOC 2 and ISO 27001 compliance requirements.
• Prepare security assessment reports with severity, evidence, reproduction steps.
• Communicate security risks to stakeholders.
• Continuously evaluate emerging threats and industry practices.
• Report findings to Chief Software Engineer.

Kenntnisse

Penetration testing

Threat modeling

Security testing

Scripting (Python/Bash)

Tools

OWASP Top 10

CI/CD tooling

AWS Security

Jobbeschreibung

3-5

Hamly Towers

Full-Time

Roles & Responsibilities – Security Engineer

• Conduct web application and API penetration testing across EHR, patient statement, and internal applications.
• Identify vulnerabilities related to authentication, authorization, IDOR, injection, session management, and business logic.
• Perform security testing based on OWASP Top 10 and OWASP API Security Top 10.
• Conduct multi-tenant security testing, including RBAC, row-level access controls, and tenant isolation.
• Review AI-assisted and low-code applications for security vulnerabilities.
• Own the application security review and pre-release security gate.
• Assess and harden AWS infrastructure, including IAM, VPC, S3, KMS, security groups, and CloudTrail.
• Implement and validate least-privilege access, secrets management, and encryption controls.
• Define application and infrastructure security logging and monitoring requirements.
• Support security incident investigation, response, and root-cause analysis.
• Coordinate with the managed 24x7 security monitoring provider for security alerts and incidents.
• Integrate SAST, DAST, and SCA tools into CI/CD pipelines.
• Tune security tools to reduce false positives and improve actionable results.
• Conduct dependency and software supply-chain security reviews, including CVE and lockfile assessments.
• Develop Python or Bash scripts to automate security checks and security processes.
• Establish and maintain application, API, cloud, and infrastructure security standards.
• Conduct vulnerability assessments and track remediation through closure and retesting.
• Perform threat modelling and identify security risks during application design and development.
• Collaborate with Product, Engineering, QA, and IT teams to implement security-by-design practices.
• Maintain security playbooks, procedures, standards, and audit evidence.
• Support security and compliance requirements related to PHI, HIPAA, SOC 2, and ISO 27001.
• Prepare security assessment reports with severity, evidence, impact, reproduction steps, and remediation recommendations.
• Communicate security risks and remediation requirements to technical and non-technical stakeholders.
• Continuously evaluate emerging threats, vulnerabilities, security tools, and industry practices.
• Report security findings, risks, and release decisions to the Chief Software Engineer.