Security Engineer (VAPT and Remediation)
Location: Pune (Hybrid)
Experience: 5+ years
About the role
This is a hands-on security engineering role that owns the full cycle: find the vulnerability, prove it, fix it, and confirm it stays fixed. You will run penetration tests and security reviews across our applications and infrastructure, then remediate what you find, in application code or in configuration, whatever the fix requires.

What you will do
Security Analysis and Testing
• Plan and execute penetration tests on web applications, APIs, mobile apps (iOS and Android), thick clients, and supporting infrastructure.
• Review application and infrastructure security design: authentication and authorization, session handling, data flows, secrets management, network exposure, and cloud configuration.
• Find what scanners miss through manual testing: business logic flaws, chained vulnerabilities, and privilege escalation paths.
• Run and tune vulnerability scans across applications, hosts, and cloud accounts.
• Triage, deduplicate,



and prioritize findings by exploitability and business impact alongside CVSS.
• Track remediation to closure and maintain an accurate view of open risk.
• Retest fixes and close findings only when the vulnerability is confirmed resolved.

Remediation and patching
• Fix vulnerabilities directly in application code, in whatever language or framework the application uses.
• Fix infrastructure and configuration issues: web server and TLS settings, cloud IAM and network rules, container and Kubernetes configuration, infrastructure-as-code, and CI/CD pipeline hardening.
• Apply patches and upgrades to operating systems, frameworks, libraries, and third-party components, and verify the exposure is closed.
• Where code or infrastructure is owned by another team, raise the change yourself as a pull request or configuration change and drive it to merge.

Reporting and communication
• Write transparent findings with reproduction steps, evidence, risk rating,

📌 Security & Compliance (India)
🏢 Sonata Software
📍 India