We are building a Lead Security Engineer - AI role to create a repeatable penetration-testing program for our products and supporting infrastructure. You will define the framework, toolchain, processes, and test environments to assess web apps, APIs, VMs, and cloud configurations across AWS and Microsoft Azure. Partner with teams to validate defenses, report risk, drive remediation, and apply today

Responsibilities

- Design and maintain a penetration-testing framework that defines methodology, scope, cadence, evidence capture, reporting, retesting, and risk tracking

- Build and configure the tools, scripts, environments, and automation needed for repeatable security assessments

- Execute manual and automated penetration testing across web applications, customer-facing portals, APIs, virtual machines, operating systems, networks, and cloud environments (IAM, storage, networking, logging, secrets, containers)

- Identify security weaknesses, confirm exploitability, evaluate business impact, and deliver practical, prioritized remediation guidance

- Develop attack scenarios that mirror modern attacker behavior, including automated reconnaissance, vulnerability discovery, credential attacks, and attack chaining

- Collaborate with software engineering, DevOps, cloud, infrastructure, product, and security teams to explain findings, assist remediation, and verify fixes via retesting

- Integrate security testing and scanning into CI/CD pipelines and day-to-day engineering workflows

- Stay current on vulnerabilities, offensive-security techniques, cloud-security threats, OWASP guidance, and emerging attack trends

Requirements





- Extensive experience with 5+ years in penetration testing, application security, offensive security, red teaming, or a comparable role

- Demonstrated experience testing web applications, APIs, cloud infrastructure, virtual machines, operating systems, and network services

- Robust knowledge of OWASP Top 10, OWASP API Security Top 10, common web and API attack techniques, and secure-development practices

- Practical experience assessing one or more major cloud platforms: AWS, Microsoft Azure, or Google Cloud Platform

- Deep understanding of identity and access management, authentication, authorization, session security, networking, encryption, secrets management, and common cloud misconfigurations

- Hands-on experience with tools such as Burp Suite, Nmap, Wireshark, Metasploit, Nessus/OpenVAS, sqlmap, and cloud-security tools

- Proficiency in scripting or programming using Python, Bash, PowerShell, JavaScript, or similar languages

- Proven ability to independently plan and execute tests, document evidence, communicate risk, and deliver concise, actionable technical reports

- Strong communication skills and the ability to work constructively with engineering and business stakeholders

Nice to have

- Experience creating internal penetration-testing frameworks, labs, tools, scripts, or security-test automation

- Experience embedding security controls or testing activities into CI/CD pipelines

- Knowledge of Docker, Kubernetes, Terraform, infrastructure as code, and container-security testing

- Relevant certifications such as OSCP, OSWE, OSEP, CRTO, CREST, GPEN, GWAPT, PNPT, CISSP, or cloud-security certifications

📌 Lead Security Engineer - AI (Pune)
🏢 EPAM Systems
📍 Pune