Job Summary

Join PayPal s Offensive Security team to help protect our products, applications, infrastructure, and emerging technologies. You ll conduct hands-on penetration testing and secure code reviews across web, mobile, APIs, cloud, infrastructure, and other environments. You ll also validate findings from AI-assisted code reviews and automated security tools, assessing exploitability and business impact while identifying complex vulnerabilities and business logic flaws.

Working closely with engineering teams, you ll translate findings into realistic attack scenarios and practical remediation guidance.

Essential Responsibilities

- Independently apply security best practices to enhance and optimize systems, ensuring robust protection and efficiency, while beginning to understand and align security solutions with business objectives.

- Partner with peers and internal teams to drive security initiatives, contribute to cross-functional projects, and at times co-lead efforts to strengthen security posture.

- Analyze and resolve security challenges by adapting standard processes and exploring alternative approaches to address complex threats.

- Influence the quality, efficiency, and effectiveness of the team through informed decision-making, with a potential impact on other teams.

- Collaborate with other engineers to gather and incorporate feedback, driving continuous improvements in security processes.

Minimum Qualifications

- 3+ years relevant experience and a Bachelor s degree OR Any equivalent combination of education and experience.

Additional Responsibilities

- 5+ years of hands-on penetration testing experience preferred, including experience managing security assessments from scoping and execution through reporting and remediation support.

- Experience conducting secure source-code reviews and identifying complex vulnerabilities and business logic flaws.

- Knowledge of application security, cloud environments, identity flows,



common attacker techniques, and the MITRE ATT&CK; framework.

- Familiarity with penetration-testing methodologies and guidance such as PTES and OWASP.

- Proficiency in a scripting language such as Python, PowerShell, or Perl.

- Software development experience with languages or platforms such as Java or Node.js is preferred.

- Experience assessing AI/ML systems or using AI-assisted security analysis and automation is a plus.

- Security certifications such as OSWE, OSCP, GPEN, GWAPT, or CEH are a plus.

- Solid technical writing, communication, critical-thinking, and attention-to-detail skills.

- Scope and execute authorized penetration tests across web, mobile, APIs, thick-client applications, cloud environments, and internal infrastructure.

- Review and validate potential vulnerabilities identified through AI-assisted code reviews and automated security tooling.

- Reproduce security findings and evaluate exploitability, business impact, severity, remediation priority, and potential false positives.

- Perform secure source-code reviews to identify complex vulnerabilities, including business logic weaknesses.

- Test authentication, authorization, session management, OAuth, OIDC, JWT, CSP, cryptography, and related application security controls.

- Evaluate AI/ML systems and apply automation to improve the efficiency and depth of security testing.

- Document vulnerabilities with clear reproduction steps, realistic attack scenarios, technical context, and actionable remediation guidance.

- Support engineering teams through remediation and closure of identified security findings.

- Assess systems against applicable security requirements, including PCI DSS.

- Conduct security research and contribute to broader Offensive Security initiatives.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 Cybersecurity Engineer (Bengaluru)
🏢 Xoom
📍 Bengaluru