CybersecurityEngineer, Fonazo The role:

Fonazo is hiring a Cybersecurity Engineer to own the security of a real-time, multi-tenant voice AI product used by enterprises in regulated industries.

Fonazo is an AI Voice Agent Builder. A business launches a multilingual voice agent in about two minutes. Each agent has its own phone number, speaks 76 languages, sends WhatsApp and SMS, connects to customer CRM and calendar systems, and records and analyses every call. The customers are banks, insurers, hospitals, logistics firms, and government bodies across India, the UAE, the US, the UK, and Europe.

That creates a security surface few products have: live voice, telephony, language models, customer integrations, call recordings, and personal data, all inside a sub-second response budget. This role secures every layer of it and gives enterprise security teams the evidence to approve Fonazo quickly.

Reports to - Founder and CEO

Base - Pune, India

Type - Full time

Experience - 4+ years in security engineering for cloud-native, multi-tenant products

What the role owns

- Security architecture across the product: identity and access, network segmentation, secrets, encryption in transit and at rest, and key management.
- Tenant isolation. One customer's agents, recordings, transcripts, contacts, and analytics are never reachable from another's, and that is proven by test.
- AI and agent security: prompt injection, data leakage through agent responses, tool and integration abuse, voice spoofing, and misuse of agents for fraud or social engineering.
- Telephony and messaging security: toll fraud, number abuse, signalling attacks, and account takeover of calling resources.
- Protection of call recordings and personal data: redaction, access logging, retention enforcement, and secure deletion.
- Integration security for customer CRM, calendar, and messaging connections: token handling, scope minimisation, and webhook validation.
- Secure development lifecycle:



threat modelling, code review, dependency and container scanning, and security gates in the release pipeline.
- Detection and response: logging, alerting, incident runbooks, on-call, and post-incident reviews.
- Offensive testing: internal penetration tests, management of external testers, and a responsible disclosure programme.
- The technical controls and evidence behind independent audits such as SOC 2 and ISO 27001, in partnership with the Compliance Engineer.
- Enterprise security reviews: architecture walkthroughs and questionnaire responses that get Fonazo approved by bank and hospital security teams.

What the candidate brings

- 4+ years securing cloud-native, multi-tenant software in production.
- Depth in cloud security, container and orchestration security, and identity and access management.
- Application security experience: threat modelling, secure code review, and API security.
- Practical incident response experience, including at least one real incident led from detection to closure.
- Offensive skills sufficient to test the product personally and to judge external findings.
- Working knowledge of language model security risks, including the OWASP Top 10 for LLM Applications.
- The judgement to add security without adding latency to a live voice call.
- Experience with real-time communications or telephony security is a robust advantage.
- Experience in BFSI, healthcare, or another regulated sector is an advantage.
- Recognised certifications such as OSCP, CISSP, or cloud security specialisations are welcome and not required.





Stack and tooling

- Fonazo does not publish its internal architecture. Fit is assessed on what the candidate has secured in production, so every application should state:
- Cloud providers and services secured, and at what scale.
- Container, orchestration, and infrastructure as code tooling worked with.
- Detection, logging, and response tooling operated, and which detections were written personally.
- Scanning and testing tools used across code, dependencies, containers, and running systems.
- Secrets management, key management, and identity systems deployed.
- Languages used for security tooling and automation.
- Real-time voice, telephony, or messaging systems secured, if any.
- AI or language model systems secured, the threats found, and the mitigations shipped.
- The security stack the candidate would choose for a real-time, multi-tenant voice AI product from zero, and why.

What success looks like

Timeframe - Outcome

30 days - Full threat model of the product and a ranked remediation plan agreed with engineering

90 days - Security gates live in the release pipeline, tenant isolation tests automated, and incident runbooks rehearsed

180 days - External penetration test completed with all critical and high findings closed, and a responsible disclosure programme open

12 months - Enterprise security reviews cleared from a standard evidence pack, with independent audit controls operating continuously

Why this role

- A security surface that combines voice, telephony, language models, and enterprise data in real time.
- First dedicated security hire, with the authority to set the architecture and the standard.
- Security that closes deals: the work is presented directly to enterprise security teams.
- Direct line to the founder and to the engineers shipping the product.

Pay: ₹30,000.00 - ₹80,000.00 per month

Work Location: In person

📌 Cyber Security Engineer (Pune)
🏢 Blessing SoftTech
📍 Pune