Senior Security Engineer

Adalat; India; Remote; INR 2,500,000 - 5,000,000; Full time

Benefits offered by this job

WFH with flexible hours

Unlimited PTO

Autonomy & ownership

Learning resources and certifications

Smart, humble peers

Parental leave

Harvard/MIT/Oxford ecosystem contacts

Job summary

Adalat AI is seeking a Senior Security Engineer to own application security across products and services. You will trace requests, identify trust gaps, and collaborate with engineers to ship fixes and verify security controls.

Responsibilities include threat-modeling, reviewing designs, testing authorizations across REST/GraphQL/WebSocket, and building automation in CI/CD. You’ll mentor teams, enforce least privilege, and help with incident response.

Qualifications

• Over 10 years in security roles, with at least 5 years focused on security work.

Responsibilities

• Review designs and code: threat-model sensitive workflows and influence implementation.
• Test authorization: assess REST, GraphQL, WebSocket for access controls.
• Find, fix, and verify vulnerabilities: reproduce findings and verify remediation.
• Lead internal security training: create best practices and establish them within teams.
• Build security automation: CI/CD checks for code, dependencies, secrets, containers.
• Partner on infrastructure: enforce least privilege and secure identities across systems.
• Support incident response and disclosure: triage reports and guide remediation.

Skills

Security engineering

Threat modeling

Code review

Manual testing

CI/CD security

Cloud IAM

Linux

Containers

Secrets management

Technical writing

Tools

Intercepting proxy

Code scanners

Job description

Adalat AI is a nonprofit building software and AI for justice systems. Our products help courts work with proceedings, documents, and legal information. We need engineers who can protect sensitive data while keeping these workflows reliable and usable.

Role Overview

We are looking for a Senior Security Engineer to take hands-on ownership of application security across our products and services. You will trace how a request moves through the system, identify where trust can fail, and work with engineers to ship and verify fixes.

Key Responsibilities

Review designs and code: Threat-model sensitive workflows and review changes early enough to influence implementation. Cover login, session lifecycle, password recovery, invitations, document access and sharing, uploads, downloads, and administrative actions.

Test authorization thoroughly: Assess REST, GraphQL, WebSocket, and service-to-service paths for missing or inconsistent controls. Build tests for cross-user and cross-organization access, revoked permissions, expired credentials, and unintended anonymous access.

Find, fix, and verify vulnerabilities: Reproduce findings safely, explain impact, write or pair on production fixes, and add regression tests. Follow changes through deployment and retesting, including checking that legitimate workflows still function.

Lead internal security training:Decide what training materials engineering teams need to follow. Come up with security best practices and ensure that they are established within teams.

Build useful security automation: Introduce and tune code, dependency, secret, container, and configuration checks in CI/CD. Make findings actionable and use regression tests and secure shared components to prevent recurring classes of bugs.

Partner on infrastructure boundaries: Work with platform and SRE engineers on least privilege, workload identities, secrets rotation, storage access, private internal endpoints, and separation of production, testing, and research.

Support response and disclosure: Triage researcher reports, investigate relevant evidence, support containment and recovery, and document remediation. Share practical guidance with engineers.

Qualifications

10+ years of experience. Atleast 5+ years of security focussed work

Strong experience securing production web applications and APIs, with examples of vulnerabilities you understood and helped fix.

Practical experience with manual testing and tools such as an intercepting proxy, code scanners, or equivalent custom tooling. You can validate results and explain false positives.

Working knowledge of cloud IAM, Linux, containers, CI/CD, and secrets management, sufficient to follow an application issue across infrastructure boundaries.

Clear technical writing, disciplined handling of sensitive data, and the ability to take a finding from discovery to verified closure with other engineers.

Useful additional experience

GraphQL, WebSockets, multi-user collaboration, and document-level access controls.

Applied cryptography and key management reviews using established libraries and protocols.

Kubernetes, Azure or GCP, and infrastructure as code.

SOC 2 or ISO 27001 implementation and audit preparation.

Work with sensitive public-sector, legal, financial, or healthcare information.

Benefits and Perks

• WFH with flexible work hours.


• Unlimited PTO.


• Autonomy and ownership.


• Learning & development resources — including certifications relevant to this role.


• Smart, humble, and friendly peers.


• Maternity and paternity leaves.


• Contacts within the Harvard / MIT / Oxford ecosystem.