Software Engineer (Security)

Location:
Pune (Hybrid)

Experience:
5+ years (about 70% software development, 30% security)

About the role
This is a development-first security role. About 70% of the work is engineering: you will fix vulnerabilities in application code, upgrade vulnerable components, and build the tooling and automation that keep issues from coming back. The other 30% is security testing across our web apps and APIs. You own each fix end to end, from the finding to a merged, tested change. What you will do Development and remediation
• Fix vulnerabilities directly in application code, in whatever language or framework the application uses, and add tests that prove the fix.
• Fix root causes, not single instances: build shared validation, output encoding, parameterized queries, and authorization checks that remove whole classes of vulnerabilities.
• Upgrade vulnerable libraries, frameworks, and third-party components, resolve breaking changes, and keep builds and tests passing.
• Build internal security tooling and automation: scanner integrations, triage and reporting scripts, and checks that catch issues before release.
• Integrate SAST, DAST, and SCA tooling such as Aikido into CI/CD pipelines, and tune the rules to cut noise.
• Fix infrastructure and configuration issues: web server and TLS settings, cloud IAM and network rules, container and Kubernetes configuration, infrastructure-as-code, and CI/CD pipeline hardening.
• Where code or infrastructure is owned by another team, raise the change yourself as a pull request and drive it to merge. Security testing
• Test web applications and APIs for exploitable vulnerabilities.




• Review code and design for flaws in authentication, authorization, session handling, data flows, and secrets management.
• Run and tune vulnerability scans across applications, hosts, or cloud accounts, and prioritize findings by exploitability and business impact alongside CVSS.
• Retest fixes and close findings only when the vulnerability is confirmed resolved. Reporting and communication
• Write clear findings and fix notes with reproduction steps, evidence, risk rating, and the change made.
• Agree on realistic remediation timelines with engineers, and share secure coding patterns so the same issues stop recurring. What you bring Experience
• 5+ years total: approx. 3.5 years building and shipping production software as a developer, and approx. 1.5+ years of hands-on security work such as VAPT, application security, or secure code review.
• A track record of fixing security issues in code. Development expertise
• Production-level depth in at least two of: Java, C#/.
NET, JavaScript/TypeScript, Python, PHP, Go, Swift, or Kotlin. Comfortable reading and changing code in languages you know less well.
• Able to land a correct, tested fix in an unfamiliar codebase without breaking existing behavior.
• Web and API development:



REST and GraphQL services; authentication with OAuth 2.0, OpenID Connect, and JWT; session management; databases and ORMs.
• Unit and integration testing, Git-based workflows, pull requests, and code review.
• CI/CD pipelines, Docker, Kubernetes, and infrastructure-as-code such as Terraform or CloudFormation.
• Working knowledge of Nginx, Apache, IIS, and TLS configuration.
• Scripting in Python, Bash, or PowerShell to automate testing and remediation. Communication
• Clear written findings and the ability to explain risk and trade-offs to engineers and business stakeholders. Nice to have
• Web and API: manual testing with Burp Suite Qualified; OWASP Top 10 and ASVS; injection, authentication and session flaws, access control (IDOR/BOLA), SSRF, and OAuth and JWT weaknesses.
• Secure code review: spotting vulnerable patterns in code and using SAST and SCA results to find and fix real issues.
• Built security tools, Burp extensions, or custom SAST rules (for example, Semgrep or CodeQL).
• Threat modeling and secure design review experience.
• Familiarity with compliance evidence requirements (ISO 27001, SOC 2, PCI DSS) as they relate to vulnerability remediation. What success looks like
• Vulnerabilities reach merged, tested fixes within agreed timelines.
• Recurring vulnerability classes decline because fixes address root causes.
• The tooling and automation you build catch issues before release and cut manual triage.
• Development teams see you as a fellow engineer who ships fixes alongside them.
• Cloud misconfiguration and patch exposure windows stay short.

📌 Security Software Engineer (India)
🏢 Sonata Software
📍 India