Job Description
Job Title
- Security Engineer – VAPT & Remediation Location
- Pune | Hybrid Qualifications
-
•

Experience:
5+ Years
• Development: 70%
• Security Testing: 30% Primary Skills
- Application Security, VAPT, Vulnerability Remediation, Secure Coding, SAST / DAST / SCA, CI/CD Security, Web Application & API Security.

About The Role
We are looking for a Security Engineer with strong software development and application security experience. This is a development-first security role, with approximately 70% focus on vulnerability remediation, secure coding, automation, and engineering, and 30% focus on security testing of web applications and APIs. The ideal candidate will be hands-on in fixing vulnerabilities directly in application code, upgrading vulnerable dependencies, building security automation, and strengthening application and infrastructure security. The candidate will own vulnerabilities end to end, from identification and root-cause analysis to remediation, testing, and closure. Roles And Responsibilities
• Identify and remediate security vulnerabilities directly in application code across different programming languages and frameworks.
• Fix root causes by implementing secure validation, output encoding, parameterized queries, and robust authorization controls.
• Upgrade vulnerable libraries, frameworks, and third-party components while resolving compatibility issues and maintaining build stability.
• Develop internal security tools and automation for vulnerability scanning, triage, reporting, and prevention.
• Integrate SAST, DAST, and SCA tools, such as Aikido, into CI/CD pipelines and optimize rules to reduce false positives.
• Remediate infrastructure and configuration vulnerabilities involving web servers, TLS, cloud IAM, network security, containers, Kubernetes, Infrastructure as Code, and CI/CD pipelines.
• Raise pull requests for security fixes across teams and drive changes through review, testing, and merging.




• Conduct VAPT and security testing of web applications and APIs to identify exploitable vulnerabilities.
• Perform code and design reviews covering authentication, authorization, session management, data flows, and secrets management.
• Run and tune vulnerability scans across applications, hosts, and cloud environments.
• Prioritize vulnerabilities based on exploitability, business impact, and CVSS severity.
• Retest vulnerabilities and validate remediation before closing findings.
• Write clear security reports documenting reproduction steps, evidence, risk ratings, root causes, and remediation details.
• Collaborate with engineering teams to establish remediation timelines and promote secure coding practices. Qualifications & Required Skills Application Development & Remediation
• Robust software development experience with the ability to fix vulnerabilities across different programming languages and frameworks.
• Experience in secure coding, code refactoring, debugging, and root-cause analysis.
• Ability to upgrade vulnerable dependencies and resolve breaking changes.
• Experience writing automated tests to validate security fixes. Application Security & VAPT
• Hands-on experience in web application and API security testing.
• Strong understanding of common application vulnerabilities, including OWASP Top 10.
• Experience reviewing authentication, authorization, session management, input validation, and data protection mechanisms.
• Ability to validate findings, reproduce vulnerabilities, and verify remediation. Security Tools & Automation
• Experience with SAST, DAST, and SCA tools.
• Familiarity with tools such as Aikido or equivalent application security platforms.




• Experience integrating security tools into CI/CD pipelines.
• Ability to build automation scripts for vulnerability scanning, triage, reporting, and remediation tracking. Infrastructure & Cloud Security
• Understanding of web server security, TLS configuration, cloud IAM, and network security.
• Experience identifying and fixing vulnerabilities in Docker, Kubernetes, and Infrastructure as Code configurations.
• Knowledge of CI/CD pipeline security and configuration hardening. Reporting & Collaboration
• Ability to document security findings with clear reproduction steps, evidence, impact, and remediation recommendations.
• Strong problem-solving and communication skills.
• Ability to collaborate with engineering teams and drive security fixes through successful deployment. MANDATORY SKILLS
- Software Development, Application Security, VAPT, Vulnerability Remediation, Secure Coding, SAST / DAST / SCA, Web Application & API Security, CI/CD Security. GOOD TO HAVE SKILLS
- Aikido, OWASP Top 10, Security Automation, Cloud Security, AWS / Azure, Docker, Kubernetes, Infrastructure as Code, Dependency Management, Vulnerability Management, Automated Security Testing. About Sonata Software Sonata Software is an AI-first modernization engineering company that helps enterprises transform legacy systems into intelligent, scalable business platforms. Powered by its Platformation™ framework and Harmoni.
AI platform, Sonata delivers AI-led modernization across cloud, data, AI, Dynamics, test automation, and managed services. Headquartered in Bengaluru, India, Sonata has more than $1.2 billion in revenue and 6,400+ AI engineers supporting global delivery across the US, UK, India, Malaysia, Mexico, Australia, DACH, and the Nordics. With deep partnerships across Microsoft, AWS, Salesforce, and Snowflake, Sonata helps Fortune 500 enterprises accelerate innovation, improve efficiency, and drive sustainable growth. For more information, please visit www.sonata-software.com .

📌 Security Engineer – VAPT (Pune)
🏢 Sonata Software
📍 Pune