We are looking for a Lead Security Engineer - AI to set up and run a reliable penetration-testing capability across our product suite and infrastructure. You will standardize methodology, tooling, and lab environments to test web apps, APIs, VMs, and cloud setups, including AWS and Microsoft Azure. Help teams strengthen defenses by validating real-world attack paths, producing clear reports, and retesting fixes—apply today

Responsibilities

- Define and own a penetration-testing framework covering methodology, scope definition, test frequency, evidence collection, reporting, retesting, and risk tracking

- Develop and maintain the tooling, scripts, environments, and automation required to run recurring security assessments

- Conduct manual and automated penetration testing for web applications, customer-facing portals, APIs, virtual machines, operating systems, networks, and cloud environments (IAM, storage, networking, logging, secrets, containers)

- Discover vulnerabilities, confirm exploitability, assess business impact, and provide practical, prioritized remediation recommendations

- Create attack scenarios aligned with contemporary attacker behavior, including automated reconnaissance, vulnerability discovery, credential attacks, and attack chaining

- Partner with software engineering, DevOps, cloud, infrastructure, product, and security teams to review findings, support remediation, and confirm fixes through retesting

- Embed security testing and scanning into CI/CD pipelines and engineering workflows

- Monitor new vulnerabilities, offensive-security techniques, cloud-security threats, OWASP guidance, and emerging attack trends

Requirements





- Proven track record with 5+ years of hands-on work in penetration testing, application security, offensive security, red teaming, or a similar function

- Hands-on experience testing web applications, APIs, cloud infrastructure, virtual machines, operating systems, and network services

- Solid background in OWASP Top 10, OWASP API Security Top 10, common web and API attack techniques, and secure-development practices

- Practical experience assessing one or more major cloud platforms: AWS, Microsoft Azure, or Google Cloud Platform

- Strong understanding of identity and access management, authentication, authorization, session security, networking, encryption, secrets management, and common cloud misconfigurations

- Practical familiarity with Burp Suite, Nmap, Wireshark, Metasploit, Nessus/OpenVAS, sqlmap, and cloud-security tools

- Programming or scripting proficiency in Python, Bash, PowerShell, JavaScript, or similar languages

- Ability to plan and execute engagements independently, capture evidence, communicate risk, and produce concise, actionable technical reports

- Excellent communication skills with the ability to work constructively with engineering and business stakeholders

Nice to have

- Experience building internal penetration-testing frameworks, labs, tools, scripts, or security-test automation

- Experience integrating security controls or testing activities into CI/CD pipelines

- Knowledge of Docker, Kubernetes, Terraform, infrastructure as code, and container-security testing

- Relevant certifications such as OSCP, OSWE, OSEP, CRTO, CREST, GPEN, GWAPT, PNPT, CISSP, or cloud-security certifications

📌 Lead Security Engineer - AI (Pune)
🏢 EPAM Systems
📍 Pune