Senior Security Engineer

INDmoney; Bengaluru; On-site; INR 1,500,000 - 2,600,000; Full time

Job summary

INDmoney is seeking a security engineer to own AWS security, guardrails, and client-facing app protection in Bengaluru. You’ll build detections, secure CI/CD, and integrate SIEM/CSPM while performing on-device and app integrity work.

You will drive incident response, threat modeling, and API security reviews, coordinating with mobile teams to fix issues before launch. A hands-on, scripting-heavy role with cloud-scale focus awaits.

Qualifications

• 3–5 years in security engineering with hands-on cloud security at scale.
• Strong scripting in Python or Go; automation is the job, not a bonus.
• OWASP Top 10, MASVS, and API Security Top 10 as working tools.

Responsibilities

• Design and enforce guardrails across multi-account AWS — IAM least privilege, SCPs, secrets.
• Build detections on CloudTrail, GuardDuty, and Config, and own the alerts you create.
• Secure our EKS and CI/CD layer: admission control, image scanning, IaC scanning, SBOM as a build artifact.
• Integrate SIEM and CSPM platforms, and write the detection rules that run on them.
• Attack our own Android and iOS builds — reverse engineer, hook with Frida, bypass detection logic, and report what you find.
• Review WebView and native bridge surfaces, deeplinks, and on-device storage for token and PII leakage.
• Run pre-release mobile pentests and drive fixes with the mobile teams.
• Working knowledge of app integrity is a plus: root/jailbreak and hooking-framework resistance.

Skills

Python

Go

Automation

Tools

AWS

GuardDuty

Config

EKS

Frida

Job description

You'll own the security of our AWS infrastructure and our client-facing web and mobile apps. This is hands-on engineering — building controls and breaking things, not filing findings for someone else to fix.

What you'll do

• Design and enforce guardrails across multi-account AWS — IAM least privilege, SCPs, secrets
• Build detections on CloudTrail, GuardDuty, and Config, and own the alerts you create
• Secure our EKS and CI/CD layer: admission control, image scanning, IaC scanning, SBOM as a build artifact
• Integrate SIEM and CSPM platforms, and write the detection rules that run on them
• Attack our own Android and iOS builds — reverse engineer, hook with Frida, bypass detection logic, and report what you find before someone else does
• Review WebView and native bridge surfaces, deeplinks, and on-device storage for token and PII leakage
• Run pre-release mobile pentests and drive fixes with the mobile teams
• Working knowledge of app integrity is a plus: root/jailbreak and hooking-framework resistance, Play Integrity / App Attest, certificate pinning and rotation

Web and application security

• Threat model and review new services, with focus on auth and money-movement flows
• Own WAF and edge security — rule authoring, bot management, bypass-path review
• API security: authorization enforcement, BOLA/IDOR classes, token and session lifecycle, OAuth/OIDC review
• Triage our responsible disclosure pipeline end to end

Incident response and assurance

• Security on-call; lead investigations across cloud, identity, and endpoint logs through to root cause and closure
• Run internal VAPT cycles and track remediation to closure

What we're looking for

• 3–5 years in security engineering, with hands‑on cloud security at scale
• Strong scripting in Python or Go; automation is the job, not a bonus
• OWASP Top 10, MASVS, and API Security Top 10 as working tools

Nice to have

• Fintech or other regulated-industry experience
• Kubernetes/EKS security depth
• CVEs, published research, CTF placements, or bug bounty track record