Security Engineer (Platform & Infra)

Knowmax; Gurugram District; On-site; INR 1,500,000 - 2,100,000; Full time

Job summary

Knowmax is looking for a Security Engineer to own vulnerability assessment and penetration testing across our web applications, APIs, networks and cloud infrastructure. The role blends offensive testing with defensive assurance to keep our OCI-based estate hardened and compliant.

You will work with Burp Suite Pro and a strong open-source toolchain to identify, validate and remediate findings, collaborating with development and infra teams to close gaps and improve overall security posture.

Qualifications

• Experience in security engineering, with 2+ years on cloud security and vulnerability assessment.
• Hands-on with OCI security services and controls.
• Track record of testing web apps and APIs for vulnerabilities and misconfigurations.
• Strong Linux/Windows fundamentals and container security knowledge.
• Familiarity with CIS, CVSS, CWE and CVE; awareness of ISO 27001/SOC 2/PCI-DSS.
• Scripting ability in Python, Bash or PowerShell for automation.

Responsibilities

• Plan and execute VAPT engagements across web apps, APIs, networks and OCI workloads.
• Identify, exploit and validate vulnerabilities using Burp Suite Pro and open-source tools.
• Assess Linux, containerized environments and cloud workloads for security gaps.
• Retest remediations to ensure vulnerabilities are closed.
• Harden OCI deployments, review Terraform/OCI Resource Manager for insecure defaults.
• Collaborate with DevSecOps to implement secure configurations and patching SLAs.
• Write clear security reports with risk ratings and actionable mitigations.
• Stay updated on threats, CVEs and tooling relevant to our stack.

Skills

OCI security services

Burp Suite Pro

VAPT

Linux fundamentals

Windows fundamentals

Scripting in Python/Bash/PowerShell

Threat & vulnerability management

Cloud & container security

Tools

Burp Suite Pro

OWASP ZAP

Nuclei

SQLMap

ffuf

OpenVAS

Gitleaks

TruffleHog

Amass

Subfinder

Job description

We are looking for a Security Engineer to own vulnerability assessment and penetration testing across our web applications, APIs, networks and cloud infrastructure. The role has two sides: offensive testing to find and validate weaknesses, and defensive assurance to keep our cloud estate hardened, compliant and fully patched.

Our platform runs primarily on Oracle Cloud Infrastructure (OCI), so hands-on OCI security experience matters. You will work with Burp Suite Professional and a strong open-source toolchain, turn findings into prioritized fixes, and work with development and infrastructure teams to close them.

What You Will Do

Security Testing

• Plan and run VAPT engagements across web apps, APIs, internal and external networks, and cloud-hosted workloads
• Identify, exploit and validate vulnerabilities through manual testing, supported by Burp Suite Professional and open-source tools
• Assess Linux and containerized environments for security gaps
• Test against OWASP Top 10, OWASP API Security Top 10, OWASP ASVS and MITRE ATT&CK
• Retest after remediation to confirm vulnerabilities are fully closed

Cloud Security (OCI)

• Continuously assess OCI tenancies for misconfigurations across IAM policies, compartments, security lists, network security groups, WAF, load balancers, Object Storage and Vault/KMS
• Run and tune Cloud Guard, Security Zones, Vulnerability Scanning Service, Bastion, Audit and Logging Analytics, and act on what they detect
• Review Terraform and OCI Resource Manager code for insecure defaults before changes reach production
• Harden OKE clusters, container images and registries with the DevOps team

Vulnerability and Patch Management

• Own the vulnerability lifecycle end to end: discovery, triage, risk rating, assignment, tracking and verification
• Run regular authenticated and unauthenticated scans across servers, endpoints, container images and cloud services
• Make sure systems are patched within severity-based SLAs, and escalate overdue items
• Maintain an accurate asset inventory so nothing falls outside scanning and patching scope

Compliance and Hardening

• Keep cloud and on-premises infrastructure aligned to CIS Benchmarks (OCI, Linux, Kubernetes) and OCI security best practices
• Run configuration reviews, track deviations and drive them to remediation
• Support ISO 27001, SOC 2 and PCI-DSS through control mapping, evidence collection and audit responses
• Contribute to hardening guides and secure configuration standards

Reporting and Collaboration

• Write clear technical and executive reports with risk ratings, business impact and practical fixes
• Track security posture, open vulnerabilities by severity, patch SLA adherence and audit readiness for management
• Stay current on new threats, CVEs and tooling relevant to our stack
• Keep all testing within authorized scope and company policy

What You Bring

• 3 to 5 years in a Security Engineer, Security Analyst or Penetration Tester role, including 2+ years securing public cloud
• Working knowledge of OCI security services and controls
• Proven ability to test and exploit web and API flaws: injection, broken access control, authentication and session issues, SSRF, deserialization and business logic abuse
• Strong Linux and Windows fundamentals, Active Directory security concepts, and container and Kubernetes security
• Hands-on ownership of scanning, triage and patch verification against SLAs
• Familiarity with CIS Benchmarks, CVSS, CWE and CVE, plus exposure to ISO 27001, SOC 2 or PCI-DSS
• Scripting in Python, Bash or PowerShell
• Clear writing, and the ability to explain risk to engineers and executives alike

Our Toolchain

We get commercial-grade results with Burp Suite Professional plus open-source and cloud-native tools. You should be comfortable working without licensed scanners.

• Web and API: Burp Suite Pro, OWASP ZAP, Nuclei, SQLMap, ffuf
• Scanning: OpenVAS / Greenbone, OCI Vulnerability Scanning Service
• Code and secrets: Semgrep, Gitleaks, TruffleHog
• Recon: Amass, Subfinder

Nice to Have

• OCI certification (Foundations, Architect Associate or Security Professional)
• OSCP or CEH
• DevSecOps exposure: SAST, DAST, SCA and secrets scanning in CI/CD

Who You Are

• Structured and evidence-driven. You own problems until they are closed, even when that means chasing fixes across teams. You handle sensitive findings with discretion and high ethical standards.