Role: Security Engineer — Application & File Security

Experience: 5+yrs

Notice period: Immediate - 15days

Work Mode: Remote

Background & Authorization

This is a remote role based in India. The engagement operates on a mid-day to late-night shift to align with the US client team. Working hours are approximately 1:00 PM – 10:30 PM IST during US Eastern Daylight Time (EDT) and 1:00 PM – 11:00 PM IST during US Eastern Standard Time (EST).

Role Purpose

Execute application-layer security remediation for TLS cipher hardening and file upload security controls under the direction of the Security Engineering Lead. Own the accurate, tested delivery of these controls — every TLS change validated against the pre-remediation compatibility survey, every file upload control tested against a comprehensive edge-case matrix. Also contributes to the security unit test pilot components.

Key Responsibilities

- Implement load balancer cipher policy changes per Security Engineering Lead design — execute in non-production, validate against compatibility survey, then promote to production through the CI/CD pipeline
- Build and deploy a containerised file upload scanner (ClamAV) — Docker multi-stage image, ECS Fargate or Lambda integration, REST API endpoint, fail-closed error handling, and horizontal auto-scaling
- Implement path traversal protection for archive file uploads (ZipSlip pattern) — archive extraction validation, path normalisation enforcement, rejection of escaping entries
- Implement insecure PDF handling controls — magic byte validation, embedded JavaScript detection, external URL reference blocking, file size limits
- Execute TLS rollback testing — validate rollback from TLS 1.3-only to TLS 1.2 AEAD-only within a maintenance window




- Produce post-remediation cipher scan evidence — compliance report confirming no deprecated cipher suites remain on any endpoint
- Build and execute a comprehensive file upload security test matrix — EICAR test file, oversized ZIP, recursive archive, malformed PDF, MIME type spoofing, double-extension filenames
- Build two pilot security unit test components — OWASP/CWE-mapped JUnit5 test cases for nominated high-risk application components

Must-Have Skills & Experience

- 5+ years application security engineering; 3+ years hands-on Java/Spring application security on production systems
- TLS/SSL — cipher suite configuration, AWS ALB Security Policy changes, TLS debugging with OpenSSL, HTTPS and HSTS configuration
- ClamAV — daemon configuration, containerised deployment, API integration, performance tuning
- Docker — multi-stage Dockerfile authoring, image hardening, container deployment on AWS ECS or Lambda
- File upload security — MIME type validation, ZipSlip/path traversal prevention, malicious file detection, magic byte validation
- PDF security — malicious PDF structure detection, embedded JavaScript identification
- Java Spring Security — filter chain configuration, security headers, CSRF protection, input validation
- AWS Lambda — function authoring in Python or Java, execution role design, VPC connectivity
- Security test case authoring — edge case coverage with audit-quality evidence documentation

Nice-to-Have Skills

- OWASP Top 10 training, CEH, or CompTIA Security+
- AWS WAF v2 — custom rule authoring for file upload restrictions
- Fortify SAST finding remediation in Java — CWE-434, CWE-22, CWE-79
- OWASP Dependency-Check for container image vulnerability scanning
- REST API security — rate limiting, content-type enforcement, API Gateway integration

Tools & Platforms ClamAV, Docker, AWS ECS Fargate, AWS Lambda, API Gateway, ALB/NLB (Security Policies), AWS Config, Java Spring Security, OpenSSL, OWASP ZAP, Jenkins, Bitbucket, Confluence

📌 Security Engineer — Application & File Security (India)
🏢 SysTechCorp
📍 India