Security Engineer III - SAAS

Interactive Brokers Group; Mumbai; On-site; INR 2,500,000 - 4,000,000; Full time

Benefits offered by this job

Competitive salary

Annual bonus (cash & stocks)

Medical & life insurance

Job summary

Interactive Brokers Group is seeking a Security Engineer III – SaaS Security to model threats across SaaS apps, cloud-native platforms, APIs, and third-party integrations. This hands-on role requires thinking like an adversary and turning complex risk into actionable fixes.

You’ll partner with product and platform engineering to drive secure-by-design outcomes for trading platforms, portals, and APIs. Join a collaborative environment that emphasizes problem-solving, efficiency, and continuous

Qualifications

• Typically 5–8 years in cybersecurity with threat modeling focus.
• Hands-on threat modeling of modern systems using structured methods.
• Strong understanding of cloud native and on-prem architectures.

Responsibilities

• Lead end-to-end threat modeling across SaaS, cloud-native, on-prem, and third-party systems.
• Map attack surface and trust boundaries using STRIDE/PASTA with DFDs.
• Translate findings into prioritized business risk with clear actions.

Skills

Threat modeling

Security architecture

Cloud security

OAuth/OIDC

SAML/SSO

MITRE ATT&CK

OWASP Top 10

DFD (Data Flow Diagrams)

Threat modeling tooling

Education

Bachelor's degree in a related field

Tools

IriusRisk

OWASP Threat Dragon

Microsoft Threat Modeling Tool

ThreatModeler

Terraform

Job description

About the Company

Interactive Brokers Group, Inc. (NASDAQ: IBKR), a member of the S&P 500, is a global financial services company headquartered in Greenwich, Connecticut, with offices in over 15 countries. Through its affiliates, Interactive Brokers provides automated trade execution and custody of securities, commodities, foreign exchange, and prediction markets on over 170 markets in numerous countries and currencies.

For more than four decades, Interactive Brokers has focused on technology, automation, and innovation to provide clients worldwide with a sophisticated, unified platform to manage their investment portfolios. We serve individual investors, hedge funds, proprietary trading groups, financial advisors, and introducing brokers.

Our culture is driven by problem-solving, efficiency, and continuous improvement. We look for individuals who are intellectually curious, collaborative, and motivated to contribute to technology that helps simplify and enhance access to global financial markets. Interactive Brokers has consistently been recognized as a top broker by respected industry sources including Barron’s, Investopedia, Stockbrokers.com, and others.

Role Overview

The Security Engineer III – SaaS Security leads structured threat modeling across the firm's SaaS applications, cloud-native platforms, APIs, andthird-party SaaS integrations to identify design level risk before it reaches production. This is a hands on, technical contributor role for someone who thinks like an adversary, understands modernmulti-tenant SaaS and cloud architecture deeply, and can turn complex technical exposure into clear, prioritized, business-relevant risk. You will partner closely with product and platform engineering to drive secure-by-design outcomes across high-risk systems such as trading platforms, client portals, and the APIs and integrations that connect them.

Key Responsibilities

End to End Threat Modeling (core focus)

• Lead threat modeling across the full deployment gamut of SaaS, cloud native, on premise, hybrid, and third-party systems, including applications, infrastructure, microservices, monoliths, APIs, network architecture, and data flows, using methodologies such as STRIDE, PASTA, or attack trees, supported by data flow diagrams (DFDs).
• Map attack surface, trust boundaries, and abuse cases across cloud, data center, network, and endpoint layers, drawing on threat knowledge bases (MITRE ATT&CK including Enterprise, Cloud/SaaS, IC/ICS, CAPEC, OWASP Top 10 and API Security Top 10).

Model environment specific risk across the ecosystem, including:

• SaaS and multi-tenant: tenant isolation, data segregation, token and secrets management, and API authorization (e.g., BOLA/IDOR, broken function level authorization).
• Identity and access: authentication and federation flows (OAuth 2.0 / OIDC, SAML/SSO, SCIM provisioning, Kerberos/Active Directory, LDAP), privileged access, and lateral movement paths.
• Cloud native (AWS, Azure, GCP): IAM andover permissioned roles, exposed storage, containers/Kubernetes, serverless, and infrastructure as code, within the relevant shared responsibility model.
• On premise and hybrid: data center and network segmentation, east west traffic, legacy and end of life systems, physical and virtualized infrastructure, on premise to cloud connectivity, and the trust boundaries between them.
• Translate technical findings into documented, prioritized business risk exposure with clear risk ratings, irrespective of where a system is hosted or how it is deployed.

Secure by Design and Engineering Partnership

• Embed threat modeling into the SDLC and architecture lifecycle, and shift security left into design and architecture reviews for new builds, migrations, and modernization of existingon-premises estates.
• Partner with product, platform, and infrastructure engineering to recommend mitigations, secure design patterns, and reference architectures across cloud andon-premises environments.
• Build and maintain reusable threat model libraries, templates, and security patterns to scale coverage across diverse deployment models.
• Supportadoption of threat modeling tooling and threat modeling as code andvalidate that recommended controls are implemented.

Integration, Supply Chain, and Ecosystem Risk

• Threat model integrations across the ecosystem, including third party SaaS, on premise and vendor systems, data flows, authentication, API exposure, webhook and OAuth scope risk, and supply chain and system to system paths (SaaS to SaaS, cloud to on premise, and B2B connectivity).
• Evaluate vendor and partner architectures where they intersect the firm's threat models and trust boundaries.
• Producehigh-quality threat models and recommendations and tailor communication for both technical and non-technical audiences.
• Brief leadership with concise, decisionready risk insights, and elevate high risk design flaws with context and recommended actions.
• Align threat models with enterprise frameworks (NIST CSF, ISO 27001, CSA Cloud Controls Matrix) and applicable financial services obligations (e.g., DORA, NYDFS 500, RBI guidance).
• Track and report key risk indicators such as threat model coverage across the estate and finding closure rates.

Required Qualifications

• Typically, 5 to 8 years in cybersecurity (or equivalent demonstrated depth) with a focus on threat modeling, application/product security, or security architecture across cloud, SaaS, andon-premise environments.
• Demonstrated, hands on threat modeling of modern and traditional systems using a structured methodology (e.g., STRIDE, PASTA) with DFDs.
• Strong understanding of both cloud native andon-premise architectures: multi tenancy, APIs, microservices, network and infrastructure design, and identity/authentication flows (OAuth/OIDC, SAML/SSO, Active Directory/Kerberos).
• Working knowledge of AWS, Azure, or GCP and their shared responsibility models, plus familiarity with data centers, networks, and hybrid infrastructure security.
• Familiarity with OWASP (Top 10 and API Security Top 10) and MITRE ATT&CK / CAPEC.
• Ability to translate technical risk into clear business terms, with strong written and verbal communication.
• Bachelor's degree in a related field or equivalent practical experience.

Preferred Qualifications

• Experience in financial services or another regulated industry (e.g., DORA, NYDFS 500, RBI guidelines).
• Hands-on with threat-modeling tooling / threat-modeling-as-code (e.g., IriusRisk, OWASP Threat Dragon, Microsoft Threat Modeling Tool, ThreatModeler).
• Experience with DevSecOps, secure SDLC, infrastructure-as-code (Terraform), containers/Kubernetes, or secure code review.
• Exposure to AI/ML or LLM application threat modeling and other emerging technology risks.
• Certifications such as CSSLP, CCSP, CISSP, or a cloud-security specialty (e.g., AWS Certified Security – Specialty, Azure Security Engineer).

Core Competencies

• Adversarial andsystems thinking.
• Deep technical understanding of cloud, SaaS, andon-premise architecture across the ecosystem.
• Secure by design, shift left mindset.
• Clear communication across technical and business audiences.
• Strong collaboration with engineering,platform, and infrastructure teams.
• Ownership and accountability for deliverables.

Company Benefits & Perks

• Competitive salary package.
• Performance based annual bonus (cash and stocks).
• Group Medical & Life Insurance.
• Modern offices with free amenities & fully stocked cafeterias.
• Monthly food card & company paid snacks.
• Hardship/shift allowance with company provided pickup & drop facility*
• Attractive employee referral bonus.
• Frequent company sponsored team building events and outings.

* Depending upon the shifts.

**The benefits package is subject to change at the management's discretion.