EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture.

Here you will collaborate with multi-national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting-edge solutions, and have an chance to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.

We are seeking an experienced Penetration Tester to establish and operate a robust, repeatable security-testing capability for our products and supporting infrastructure. The role will design the penetration-testing framework, toolset, processes, and test environments needed to conduct regular assessments across web applications, APIs, virtual machines, cloud configurations, and related infrastructure. A key objective is to validate defenses against modern attack techniques and maintain high security coverage across the business product offering.

Responsibilities

- Design, implement, and maintain a penetration-testing framework covering methodology, scope definition, test frequency, evidence collection, reporting, retesting, and risk tracking
- Build, configure, and maintain the tools, scripts, environments, and automation required for recurring security assessments
- Perform manual and automated penetration testing of web applications, customer-facing portals, APIs, virtual machines, operating systems, networks, and cloud environments (IAM, storage, networking, logging, secrets, containers)
- Identify vulnerabilities, validate exploitability,



assess business impact, and provide practical, prioritized remediation recommendations
- Design attack scenarios reflecting modern attacker behavior, including automated reconnaissance, vulnerability discovery, credential attacks, and attack chaining
- Collaborate with software engineering, DevOps, cloud, infrastructure, product, and security teams to explain findings, support remediation, and confirm fixes through retesting
- Integrate appropriate security testing and scanning into CI/CD pipelines and engineering workflows
- Stay current on vulnerabilities, offensive-security techniques, cloud-security threats, OWASP guidance, and emerging attack trends

Requirements

- 8+ years of hands-on experience in penetration testing, application security, offensive security, red teaming, or a similar role
- Proven experience testing web applications, APIs, cloud infrastructure, virtual machines, operating systems, and network services
- Strong knowledge of OWASP Top 10, OWASP API Security Top 10, common web and API attack techniques, and secure-development practices
- Practical experience assessing one or more major cloud platforms: AWS, Microsoft Azure, or Google Cloud Platform
- Strong understanding of identity and access management, authentication, authorization, session security, networking, encryption, secrets management,



and common cloud misconfigurations
- Hands-on experience with tools such as Burp Suite, Nmap, Wireshark, Metasploit, Nessus/OpenVAS, sqlmap, and cloud-security tools
- Proficiency in scripting or programming using Python, Bash, PowerShell, JavaScript, or similar languages
- Ability to independently plan and execute tests, document evidence, communicate risk, and deliver concise, actionable technical reports
- Strong communication skills and the ability to work constructively with engineering and business stakeholders

Nice to have

- Experience building internal penetration-testing frameworks, labs, tools, scripts, or security-test automation
- Experience integrating security controls or testing activities into CI/CD pipelines
- Knowledge of Docker, Kubernetes, Terraform, infrastructure as code, and container-security testing
- Relevant certifications such as OSCP, OSWE, OSEP, CRTO, CREST, GPEN, GWAPT, PNPT, CISSP, or cloud-security certifications

We offer

- Opportunity to work on technical challenges that may impact across geographies
- Vast opportunities for self-development: online university, knowledge sharing opportunities globally, learning opportunities through external certifications
- Opportunity to share your ideas on international platforms
- Sponsored Tech Talks & Hackathons
- Unlimited access to LinkedIn learning solutions
- Possibility to relocate to any EPAM office for short and long-term projects
- Focused individual development
- Benefit package:
- Health benefits
- Retirement benefits
- Paid time off
- Flexible benefits

- Forums to explore beyond work passion (CSR, photography, painting, sports, etc.)

📌 Senior/Lead Security Engineer - AI (Pune)
🏢 EPAM Systems
📍 Pune