Location: India — Remote

Position: Full-time

Compensation: ₹24-27 lakh per year, based on experience and qualifications

Work hours: U.S. Eastern Time business hours

Paid leave: Two weeks per year, accrued over the year

Benefits: No health insurance or other benefits provided

About Symosis

Symosis Security is a cybersecurity consulting and engineering firm founded in 2007. We help organizations assess risk, secure products and infrastructure, and build effective security operations. Our services span AI security, security advisory, penetration testing, security engineering and automation, and managed security.

Our approach is engineering-led, hands-on, and vendor-independent. You’ll work directly with experienced security practitioners and client teams to solve technical challenges and deliver measurable improvements.

About the role

You’ll review and test products, assess security architectures, and build automation that improves security delivery. The role combines hands-on product security, Responsible AI reviews, and security engineering, with direct ownership of assessments, findings, and remediation validation.

Responsibilities

Product security and architecture reviews

- Lead end-to-end security reviews of services, features, APIs, and Model Context Protocol (MCP) servers, including scoping, threat modeling, testing, and reporting.
- Document reproducible findings, score applicable vulnerabilities using CVSS, and recommend concrete mitigations.
- Conduct Responsible AI (RAI) reviews of GenAI features and LLM agents, assessing misuse, data exposure, safeguards, and human oversight.
- Review application, cloud, SaaS, and identity architectures, covering data flows, trust boundaries, authentication, authorization, integrations, and sensitive data handling.




- Assess third-party vendors through architecture documentation, SOC 2 reports, penetration test results, and supporting evidence.

Security engineering and automation

- Build and enhance services, scripts, API integrations, and workflows for evidence collection, configuration validation, security monitoring, remediation, and reporting.
- Automate review checklists, scope validation, and ticket creation.
- Follow secure coding standards and submit code for peer review and security scanning.
- Test and document automations, including deployment instructions and operational runbooks.

Delivery ownership

- Own assessments from scope confirmation through findings walkthrough and remediation validation.
- Communicate findings and practical recommendations directly to client teams.
- Track findings with assigned owners and verify fixes with supporting evidence.
- Deliver work within agreed timelines and flag dependencies or blockers early.

Essential qualifications

- 6+ years of relevant hands-on cybersecurity experience, including at least 3 years in software development or security automation.
- Demonstrated experience with security architecture reviews, threat modeling using STRIDE or a similar methodology, and CVSS scoring.
- Experience assessing third-party vendors and interpreting SOC 2 reports and penetration test results.
- Strong proficiency in Python and at least one additional language, such as Java, Go, or TypeScript/Node.js.
- Experience building and consuming REST APIs.




- Working knowledge of OWASP Top 10, secure coding practices, and secrets management.
- Ability to write explicit technical findings and communicate recommendations to engineering and business stakeholders.

Preferred qualifications

- Experience securing AI/ML systems, LLM applications, agent frameworks, and MCP integrations.
- Familiarity with OWASP LLM Top 10, NIST AI RMF, or ISO/IEC 42001.
- Experience building GRC or security operations tooling for evidence collection and control validation.
- Experience with AWS security services and Jira, Confluence, or Slack APIs.
- Knowledge of data privacy, classification, and protection requirements for PII and financial data.
- Certifications such as CISSP, CCSP, CSSLP, GIAC, or AWS Security Specialty.
- Experience in a regulated fintech or tax environment.

Deliverables and success measures

- Security and RAI reviews completed within agreed turnaround times.
- Clear, reproducible findings with appropriate severity ratings, actionable mitigations, and assigned owners.
- Remediation verified, with evidence attached to tickets.
- Reliable automations delivered, tested, documented, and handed off.

How to apply

Apply through this posting and email your resume to [email protected] with the subject “Senior Security Engineer – [Your Name]”.

Include the following in your email:

- Current location and total years of relevant experience.
- Current and expected annual compensation.
- Notice period and earliest start date.
- Confirmation that you can work U.S. Eastern Time business hours.
- Relevant security certifications.
- In up to five lines, summarize your hands-on product security and AI security experience and explain why you are a strong fit for this role.

📌 Senior Security Engineer — Product Security, AI & Automation (India)
🏢 Symosis Security
📍 India