WE ARE HIRING | Senior Security Engineer (Application & Infrastructure Security) ?

Location:
Bangalore, India (On-site) ? Employment Type: Full-time ?‍?

Experience:
4–5 Years ? Department: Engineering – Information Security

About the Role
We operate a cloud-native digital wallet and payments platform on Google Cloud, powered by Go backend microservices, Flutter mobile applications for Android and iOS, and React web portals. As we handle customer funds and payment card data, security is central to everything we build. We are looking for a hands-on Senior Security Engineer to identify and help resolve security vulnerabilities across our entire platform, including source code, web and mobile applications, APIs, servers, cloud infrastructure, and networks. You will conduct security scans, code reviews, vulnerability assessments, and penetration tests while working closely with developers and DevOps engineers to strengthen our security posture. You should also have a good understanding of security policies, procedures, and compliance requirements, particularly PCI DSS. What You Will Do 1. Application Security & Code Review
• Perform secure code reviews of Go backend services, Flutter mobile code, and React web applications, both manually and using security tools.
• Run and optimise Static Application Security Testing (SAST), Software Composition Analysis (SCA), and secrets scanning.
• Integrate security testing tools into CI/CD pipelines.
• Conduct Dynamic Application Security Testing (DAST) on web applications and APIs.
• Test REST APIs against the OWASP API Security Top 10, including authentication, authorisation, rate limiting, and data exposure.
• Test web applications against OWASP Top 10 and ASVS standards.
• Participate in threat modelling and security design reviews for new features and integrations. 2. Mobile Application Security
• Perform static and dynamic security testing of Android and iOS applications, following OWASP MASVS and MASTG.
• Test for insecure storage, weak cryptography, certificate pinning bypass, root/jailbreak detection bypass, reverse engineering, and application tampering.
• Review mobile application communication with backend APIs and recommend security improvements. 3. Vulnerability Assessment & Penetration Testing
• Conduct regular internal and external vulnerability assessments across servers, containers, Kubernetes clusters, databases, and network devices.
• Perform internal and external penetration tests on applications, APIs,



cloud environments, and network infrastructure.
• Review Google Cloud configurations, IAM, firewall rules, and exposed services for security misconfigurations.
• Assess container images and Kubernetes workloads for vulnerabilities and insecure configurations.
• Coordinate with external penetration testers and ASV scan vendors, and validate their findings. 4. Remediation & Reporting
• Prepare explicit vulnerability reports with severity ratings (CVSS), proof of concept, and practical remediation guidance.
• Work with developers and DevOps engineers to resolve identified vulnerabilities and conduct retesting.
• Track security findings through closure within agreed timelines.
• Report security posture and vulnerabilities to management.
• Support incident response and investigate security events and suspicious activities. 5. Policy, Compliance & Awareness
• Understand and implement the company's security policies and procedures in daily activities.
• Support PCI DSS requirements, including vulnerability management, secure development, quarterly scans, and annual penetration testing.
• Assist in preparing security audit evidence.
• Conduct secure-coding awareness sessions and share security best practices across teams. What We Are Looking For Required Qualifications
• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• 4–5 years of hands-on experience in Application Security, Penetration Testing, or Security Engineering.
• Proven experience performing penetration tests on web applications, APIs, and internal and external infrastructure.
• Hands-on experience testing Android and iOS applications.
• Ability to read and review source code for security vulnerabilities, with familiarity in Go, Dart/Flutter, JavaScript/TypeScript, or similar languages.
• Strong working knowledge of OWASP Top 10, OWASP API Security Top 10, and OWASP MASVS/MASTG.
• Hands-on experience with security tools such as Burp Suite, OWASP ZAP, Nmap, Metasploit, Nessus, OpenVAS, Qualys, MobSF, Frida, Semgrep, SonarQube, Trivy, and similar tools.




• Good understanding of networking, Linux, TLS, authentication protocols (OAuth2, JWT), and common cryptography vulnerabilities.
• Experience assessing cloud environments, preferably Google Cloud, and containers/Kubernetes.
• Ability to prepare clear and actionable vulnerability reports with CVSS scoring.
• Awareness of security policies, procedures, and standards such as PCI DSS and ISO 27001.
• Robust written and spoken English communication skills. Strong Plus
• Experience in FinTech, payments, banking, or another regulated industry.
• Hands-on experience with PCI DSS requirements, ASV scans, or audit preparation.
• Security certifications such as OSCP, OSWE, eWPTX, GPEN, GWAPT, CEH, CompTIA PenTest+, or eMAPT.
• Experience integrating security tools into CI/CD pipelines (DevSecOps).
• Scripting skills in Python, Bash, or Go to automate security testing.
• Experience with bug bounty programmes or published CVEs.
• Experience with SIEM, log analysis, or incident response. What Makes You a Great Fit
• You think like an attacker but work like a partner to the engineering team.
• You are thorough, curious, and persistent when identifying security weaknesses.
• You communicate risks clearly and provide developers with practical solutions.
• You follow up until security issues are successfully resolved.
• You stay updated on emerging vulnerabilities, attack techniques, and security tools.

What We Offer
• Hands-on ownership of security testing across a live payments platform.
• Exposure to payments security, card data protection, and PCI DSS.
• Opportunity to work with modern technologies: Go, Google Cloud, Kubernetes, Flutter, and React.
• Support for security certifications and professional training.
• A collaborative engineering environment with opportunities for growth.
• Competitive compensation and benefits.

How to Apply
Interested candidates can apply directly through LinkedIn with their updated CV. [email protected] [ Subject : Senior Security Engineer (Application &Infrastructure; Security) , Name ] Please mention your relevant security certifications and share links to published CVEs, bug bounty profiles, technical write-ups, or CTF results, if available. Selection Process:
• Technical screening.
• Hands-on security testing exercise.
• Final interview. Join AZ eWallet and help us build a more secure digital payments ecosystem

📌 Senior Security Engineer (Bengaluru)
🏢 AZ eWallet
📍 Bengaluru