Senior/Lead Security Engineer - AI

Epam Systems; Pune District; On-site; INR 2,800,000 - 3,600,000; Full time

Job summary

Epam Systems in Pune is seeking an experienced Penetration Tester to design and operate a robust security-testing program across web apps, APIs, cloud configurations, and supporting infrastructure.

You will build testing frameworks, run automated and manual assessments, and collaborate with engineering and security teams to remediate findings and strengthen defenses across the product line.

Qualifications

• 8+ years of hands-on experience in penetration testing, application security, offensive security, red teaming, or a similar role.
• Proven experience testing web applications, APIs, cloud infrastructure, virtual machines, operating systems, and network services
• Strong knowledge of OWASP Top 10, OWASP API Security Top 10, common web and API attack techniques, and secure-development practices
• Practical experience assessing one or more major cloud platforms: AWS, Microsoft Azure, or Google Cloud Platform
• Strong understanding of identity and access management, authentication, authorization, session security, networking, encryption, secrets management, and common cloud misconfigurations
• Hands-on experience with tools such as Burp Suite, Nmap, Wireshark, Metasploit, Nessus/OpenVAS, sqlmap, and cloud-security tools
• Proficiency in scripting or programming using Python, Bash, PowerShell, JavaScript, or similar languages
• Ability to independently plan and execute tests, document evidence, communicate risk, and deliver concise, actionable technical reports
• Strong communication skills and the ability to work constructively with engineering and business stakeholders

Responsibilities

• Design, implement, and maintain a penetration-testing framework covering methodology, scope definition, test frequency, evidence collection, reporting, retesting, and risk tracking
• Build, configure, and maintain the tools, scripts, environments, and automation required for recurring security assessments
• Perform manual and automated penetration testing of web applications, customer-facing portals, APIs, virtual machines, operating systems, networks, and cloud environments (IAM, storage, networking, logging, secrets, containers)
• Identify vulnerabilities, validate exploitability, assess business impact, and provide practical, prioritized remediation recommendations
• Design attack scenarios reflecting modern attacker behavior, including automated reconnaissance, vulnerability discovery, credential attacks, and attack chaining
• Collaborate with software engineering, DevOps, cloud, infrastructure, product, and security teams to explain findings, support remediation, and confirm fixes through retesting
• Integrate appropriate security testing and scanning into CI/CD pipelines and engineering workflows
• Stay current on vulnerabilities, offensive-security techniques, cloud-security threats, OWASP guidance, and emerging attack trends

Skills

Penetration testing

OWASP Top 10

Cloud platforms

Scripting

CI/CD integration

Team collaboration

Communication

Threat modeling

Threat hunting

Tools

Burp Suite

Nmap

Wireshark

Metasploit

Nessus/OpenVAS

sqlmap

Cloud security tools

Job description

We are seeking an experienced Penetration Tester to establish and operate a robust, repeatable security-testing capability for our products and supporting infrastructure. The role will design the penetration-testing framework, toolset, processes, and test environments needed to conduct regular assessments across web applications, APIs, virtual machines, cloud configurations, and related infrastructure. A key objective is to validate defenses against modern attack techniques and maintain high security coverage across the business product offering.

Responsibilities

• Design, implement, and maintain a penetration-testing framework covering methodology, scope definition, test frequency, evidence collection, reporting, retesting, and risk tracking
• Build, configure, and maintain the tools, scripts, environments, and automation required for recurring security assessments
• Perform manual and automated penetration testing of web applications, customer-facing portals, APIs, virtual machines, operating systems, networks, and cloud environments (IAM, storage, networking, logging, secrets, containers)
• Identify vulnerabilities, validate exploitability, assess business impact, and provide practical, prioritized remediation recommendations
• Design attack scenarios reflecting modern attacker behavior, including automated reconnaissance, vulnerability discovery, credential attacks, and attack chaining
• Collaborate with software engineering, DevOps, cloud, infrastructure, product, and security teams to explain findings, support remediation, and confirm fixes through retesting
• Integrate appropriate security testing and scanning into CI/CD pipelines and engineering workflows
• Stay current on vulnerabilities, offensive-security techniques, cloud-security threats, OWASP guidance, and emerging attack trends

Requirements

• 8+ years of hands-on experience in penetration testing, application security, offensive security, red teaming, or a similar role
• Proven experience testing web applications, APIs, cloud infrastructure, virtual machines, operating systems, and network services
• Strong knowledge of OWASP Top 10, OWASP API Security Top 10, common web and API attack techniques, and secure-development practices
• Practical experience assessing one or more major cloud platforms: AWS, Microsoft Azure, or Google Cloud Platform
• Strong understanding of identity and access management, authentication, authorization, session security, networking, encryption, secrets management, and common cloud misconfigurations
• Hands-on experience with tools such as Burp Suite, Nmap, Wireshark, Metasploit, Nessus/OpenVAS, sqlmap, and cloud-security tools
• Proficiency in scripting or programming using Python, Bash, PowerShell, JavaScript, or similar languages
• Ability to independently plan and execute tests, document evidence, communicate risk, and deliver concise, actionable technical reports
• Strong communication skills and the ability to work constructively with engineering and business stakeholders

Nice to have

• Experience building internal penetration-testing frameworks, labs, tools, scripts, or security-test automation
• Experience integrating security controls or testing activities into CI/CD pipelines
• Knowledge of Docker, Kubernetes, Terraform, infrastructure as code, and container-security testing
• Relevant certifications such as OSCP, OSWE, OSEP, CRTO, CREST, GPEN, GWAPT, PNPT, CISSP, or cloud-security certifications