Sr. Software Engineer (SDE-1 DevOps & Security)

Pluang; Gurugram District; On-site; INR 1,000,000 - 1,600,000; Full time

Job summary

Pluang Technologies India Private Limited in Gurgaon, Haryana, India, is seeking a Security Engineer (SDE-1) to join our security team. You will work on application security testing, API security, and secure code reviews while embedding security into CI/CD pipelines.

The role offers hands-on exposure to SOC operations, incident response, and cloud security within a fintech context. We value curiosity, collaboration, and a strong foundation in security best practices.

Qualifications

• 0–2 years of experience or strong academic exposure to security testing tools (SAST/DAST).
• Solid understanding of REST/GraphQL security and OAuth/JWT.
• Familiarity with MASVS, mobile security basics, and secure coding.
• Programming in Java, Python, Go, or Rust; scripting in Python/Bash.
• Strong fundamentals in networking and OS internals.

Responsibilities

• Perform AppSec testing across codebases and apps under guidance.
• Review API security and identify authN/AuT flaws in endpoints.
• Support secure code reviews and identify OWASP Top 10 risks.
• Triage and remediate vulnerabilities with engineering teams.
• Integrate security tooling into CI/CD pipelines.
• Assist in vulnerability management for third‑party components.
• Monitor SOC alerts and participate in on‑call rotation.

Skills

Security testing

API security

Cloud security

Incident response

Scripting (Python/Bash)

Networking basics

Linux/Windows

Education

Bachelors in CS/InfoSec

Tools

BurpSuite

OWASP ZAP

SIEM

EDR

Elasticsearch

OpenSearch

Splunk

Wazuh

CrowdStrike

Sentinel

Job description

Sr. Software Engineer (SDE-1 DevOps & Security) Pluang Technologies India Private Limited, Gurgaon, Haryana, India 0 - 2 Years Full Time

Job Description

Security Engineer (SDE-1)

Pluang is Indonesia's leading multi-asset investment platform, offering products such as Crypto, US stocks, mutual funds, and gold. At Pluang, we're on a mission to redefine the way people invest. As one of the fastest-growing fintech platforms in Indonesia, we empower users to achieve financial independence through a seamless, innovative, and secure investment experience. Explore more about us here!

We're hiring a Security Engineer (SDE-1) to join our security team and help us secure the next generation of fintech products. This is a great role for someone early in their security career who wants hands‑on exposure to detection engineering, incident response, and cloud security in a fast-moving fintech environment, working closely with senior engineers on the team.

What You Will Do

Application Security (AppSec)

Work on static and dynamic application security testing (SAST/DAST) across codebases and applications under guidance.

Conduct API security testing and review REST/GraphQL endpoints for authorization and authentication flaws.

Support secure code reviews and help identify common software vulnerabilities (OWASP Top 10) in development pipelines.

Work with engineering teams to triage, track, and remediate application security vulnerabilities.

Assist in integrating security tooling and guardrails into CI/CD pipelines and developer workflows.

Support vulnerability management for third‑party libraries, APIs, and open‑source components (SCA).

Security Operations Center (SOC)

Monitor security alerts and dashboards (SIEM/EDR/WAF) and triage based on defined playbooks and runbooks.

Support senior engineers in investigating and responding to security incidents, escalating per runbook when needed.

Participate in rotational on‑call/shift coverage as part of the security operations team.

What We're Looking For

0–2 years of experience with, or strong academic/project exposure to: BurpSuite, OWASP ZAP, SIEM, EDR, and log management platforms (Elasticsearch, OpenSearch, Splunk, Wazuh, CrowdStrike, Sentinel, etc.).

API & Web Security: Solid understanding of REST/GraphQL API security, common vulnerabilities, and authentication/authorization mechanisms (e.g., OAuth2, JWT).

Depth in Mobile Application Security (MASVS standards, basic Android/iOS reverse engineering, dynamic analysis).

Familiarity with secure coding principles and code review practices in common languages like Java, Python, Go, Rust etc.

Solid fundamentals in networking and operating systems (TCP/IP, DNS, Linux/Windows internals) and how common attacks exploit them.

Basic scripting ability (Python or Bash) to support automation and log analysis.

Exposure to SIEM/log analysis concepts (e.g., Elasticsearch, OpenSearch, Splunk, Wazuh) through coursework, labs, internships, or personal projects.

Strong willingness to learn, good analytical and problem‑solving skills, and the ability to work collaboratively with compliance, risk, and engineering teams.

A degree in Computer Science, Information Security, or a related field, or equivalent Offensive security or AppSec certifications/practical experience (e.g., BSCP, eJPT, CPTS, PNPT, or active Bug Bounty / CTF participation).

Willingness to work in a rotational/on‑call shift schedule as part of the security operations team.

Good to Have Experience / Skills

Hands‑on exposure to DevSecOps tools and pipeline security integration (e.g., Snyk, SonarQube, Semgrep, Trivy, Dependabot).

Exposure to EDR tools (CrowdStrike, Sentinel) and WAF solutions (Cloudflare, Akamai, AWS WAF), and how detection policies are tuned.

Exposure to cloud environments (AWS/GCP/Azure) and basic cloud logging concepts (e.g., CloudTrail, Security Command Center).

Familiarity with MITRE ATT&CK and general threat hunting concepts.

Exposure to SOAR platforms and security automation.

Familiarity with container and Kubernetes monitoring/logging concepts.

Prior internship or project experience in a SOC, blue team, or security operations setting.

Interest or coursework/self‑study in forensic investigation tools and techniques.

We are an equal‑opportunity employer and value diversity at our company. We do not discriminate based on race, religion, colour, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.