The Role

We are looking for a Security Engineer to own vulnerability assessment and penetration testing across our web applications, APIs, networks and cloud infrastructure. The role has two sides: offensive testing to find and validate weaknesses, and defensive assurance to keep our cloud estate hardened, compliant and fully patched.

Our platform runs primarily on Oracle Cloud Infrastructure (OCI), so hands-on OCI security experience matters. You will work with Burp Suite Professional and a strong open-source toolchain, turn findings into prioritized fixes, and work with development and infrastructure teams to close them.

What You Will Do

Security Testing

- Plan and run VAPT engagements across web apps, APIs, internal and external networks, and cloud-hosted workloads
- Identify, exploit and validate vulnerabilities through manual testing, supported by Burp Suite Professional and open-source tools
- Assess Linux and containerized environments for security gaps
- Test against OWASP Top 10, OWASP API Security Top 10, OWASP ASVS and MITRE ATT&CK;
- Retest after remediation to confirm vulnerabilities are fully closed

Cloud Security (OCI)

- Continuously assess OCI tenancies for misconfigurations across IAM policies, compartments, security lists, network security groups, WAF, load balancers, Object Storage and Vault/KMS
- Run and tune Cloud Guard, Security Zones, Vulnerability Scanning Service, Bastion, Audit and Logging Analytics, and act on what they detect
- Review Terraform and OCI Resource Manager code for insecure defaults before changes reach production
- Harden OKE clusters, container images and registries with the DevOps team

Vulnerability and Patch Management





- Own the vulnerability lifecycle end to end: discovery, triage, risk rating, assignment, tracking and verification
- Run regular authenticated and unauthenticated scans across servers, endpoints, container images and cloud services
- Make sure systems are patched within severity-based SLAs, and escalate overdue items
- Maintain an accurate asset inventory so nothing falls outside scanning and patching scope

Compliance and Hardening

- Keep cloud and on-premises infrastructure aligned to CIS Benchmarks (OCI, Linux, Kubernetes) and OCI security best practices
- Run configuration reviews, track deviations and drive them to remediation
- Support ISO 27001, SOC 2 and PCI-DSS through control mapping, evidence collection and audit responses
- Contribute to hardening guides and secure configuration standards

Reporting and Collaboration

- Write transparent technical and executive reports with risk ratings, business impact and practical fixes
- Track security posture, open vulnerabilities by severity, patch SLA adherence and audit readiness for management
- Stay current on new threats, CVEs and tooling relevant to our stack
- Keep all testing within authorized scope and company policy

What You Bring

- 3 to 5 years in a Security Engineer, Security Analyst or Penetration Tester role,



including 2+ years securing public cloud
- Working knowledge of OCI security services and controls
- Proven ability to test and exploit web and API flaws: injection, broken access control, authentication and session issues, SSRF, deserialization and business logic abuse
- Strong Linux and Windows fundamentals, Active Directory security concepts, and container and Kubernetes security
- Hands-on ownership of scanning, triage and patch verification against SLAs
- Familiarity with CIS Benchmarks, CVSS, CWE and CVE, plus exposure to ISO 27001, SOC 2 or PCI-DSS
- Scripting in Python, Bash or PowerShell
- Clear writing, and the ability to explain risk to engineers and executives alike

Our Toolchain

We get commercial-grade results with Burp Suite Professional plus open-source and cloud-native tools. You should be comfortable working without licensed scanners.

- Web and API: Burp Suite Pro, OWASP ZAP, Nuclei, SQLMap, ffuf
- Network: Nmap, Metasploit, Wireshark, Impacket
- Scanning: OpenVAS / Greenbone, OCI Vulnerability Scanning Service
- Cloud posture: Prowler, ScoutSuite, Cloud Guard
- Containers: Trivy, Grype, kube-bench
- Hardening: OpenSCAP, Lynis
- Code and secrets: Semgrep, Gitleaks, TruffleHog
- Recon: Amass, Subfinder

Nice to Have

- OCI certification (Foundations, Architect Associate or Security Professional)
- OSCP or CEH
- DevSecOps exposure: SAST, DAST, SCA and secrets scanning in CI/CD

Who You Are

- Structured and evidence-driven. You own problems until they are closed, even when that means chasing fixes across teams. You handle sensitive findings with discretion and high ethical standards.

📌 Platform Security Engineer (VAPT & Infra) (Gurugram)
🏢 Knowmax
📍 Gurugram