Senior Security Engineer – Vulnerability Management & Penetration Testing

Truveta; Hyderabad; On-site; INR 1,200,000 - 2,000,000; Full time

Job summary

Truveta is seeking a Senior Security Engineer in Hyderabad to focus on vulnerability management and penetration testing. This role requires extensive experience in security engineering, including hands-on identification and remediation of security issues in applications and infrastructure. Successful candidates will have a strong background in web and API security testing, alongside the ability to work collaboratively with engineering teams to enhance security practices. The position offers opportunities to make impactful contributions in a mission-driven organization.

Qualifications

• 5–9+ years of experience in security engineering, vulnerability management, or penetration testing.
• Hands‑on experience with web and API security testing.
• Strong understanding of attack techniques and exploitation methods.

Responsibilities

• Drive vulnerability management lifecycle with continuous scanning.
• Perform penetration testing on web applications, APIs, and cloud environments.
• Partner with engineering teams to fix vulnerabilities.

Skills

Security engineering

Vulnerability management

Penetration testing

Web and API security

Cloud environments (Azure)

Tools

SAST

DAST

Security scanning tools

Job description

Senior Security Engineer – Vulnerability Management & Penetration Testing

Truveta provides unprecedented real‑world data and real‑time intelligence, powered by a dataset built with and owned by US health systems united in a mission of Saving Lives with Data. Together, we power breakthrough medical discoveries, accelerate regulatory‑grade evidence, and improve patient care. Today, Truveta enables research on more than 130 million de‑identified patients across the US.

Achieving Truveta’s ambitious mission requires an incredible team of talented and inspired people with a special combination of health, software and big data experience who share our company values.

Role Overview

We are looking for a Senior Security Engineer to drive vulnerability management and penetration testing across applications and infrastructure.

This role is focused on hands‑on identification, validation, and remediation of security issues, with an emphasis on building scalable processes and improving overall security posture.

Key Responsibilities

• Own andoperatethe vulnerability management lifecycle, including:
• Continuous scanning (applications, infrastructure, dependencies)
• Risk‑based prioritization
• Tracking and driving remediation
• Perform penetration testing on web applications, APIs, and cloud environments.
• Validate and triage vulnerabilities to eliminate false positives and ensure actionable findings.
• Partner with engineering teams to fix vulnerabilities and prevent recurrence.
• Implement and manage tools for:
• SAST, DAST, and dependency scanning
• Infrastructure and container scanning
• Develop repeatable testing methodologies and automation.
• Conduct adversarial testing and exploit validation to simulate real‑world attack scenarios.
• Track metrics and report on risk posture and remediation progress.
• Contribute to improving secure development practices based on findings.

Required Qualifications

• 5–9+ years of experience in security engineering, vulnerability management, or penetration testing.
• Hands‑on experience with:
• Web and API security testing
• Common vulnerabilities (OWASP Top 10, misconfigurations, auth flaws)
• Strong understanding of attack techniques and exploitation methods.
• Experience with security scanning tools and frameworks.
• Ability to analyze and validate vulnerabilities in real‑world systems.
• Familiarity with cloud environments (Azure preferred).

Preferred Qualifications

• Experience with automating security testing in CI/CD pipelines.
• Familiarity with container and Kubernetes security.
• Experience with bug bounty or red teaming.

WhatWe’reLooking For

• Strong hands‑on tester and problem solver.
• Ability to go beyond tools and think like an attacker.
• Focus on impact‑driven security, not just findings.