Role Summary The Security Specialist makes the platform secure by design and ready for enterprise customer security reviews. You shape the security architecture, drive vulnerability management and remediation, and assemble the compliance evidence needed for GA.

Key Responsibilities

Architecture and Threat Modelling

- Threat models: Run STRIDE threat modelling for tenancy, identity, APIs, media upload/streaming, plugin sandbox, GPU workers and migration; track mitigations to closure.
- Isolation: Review tenant isolation at API, database, cache, queue and object-storage layers; define cross-tenant test cases with QA.
- Zero-trust: Define service identity, mTLS, network segmentation, least-privilege IAM and workload identity for Kubernetes.

Cryptography and Secrets

- Encryption: Specify TLS 1.2+/1.3 policy, encryption at rest, envelope encryption with per-tenant data keys, key rotation and KMS access policies.
- Secrets: Implement secrets lifecycle (no secrets in code or images, short-lived credentials, rotation, scanning for leaks).

Application and Supply-chain Security

- SDLC: Embed SAST, DAST, SCA, container and IaC scanning in CI/CD with severity SLAs; manage SBOMs and image signing.
- API and web: Review for OWASP Top 10 and API Security Top 10: broken object-level authorisation, injection, SSRF, unsafe file upload (media validation, malware scanning), rate limiting, CORS and CSP.
- AI-generated code: Define review gates and scanning rules for AI-generated code and agentic tool permissions.

Identity and Access

- Review SSO (SAML/OIDC), SCIM, token handling, session management, MFA and RBAC design; define audit-log requirements and tamper-evidence.

Vulnerability, Testing and Response





- Vulnerability management: Run triage, prioritisation (CVSS and exploitability) and tracking of findings.
- Penetration testing: Scope and coordinate external penetration tests, verify fixes and retest.
- Detection and response: Define security logging, SIEM integration, alerting and an incident response plan with runbooks.

Compliance

- Controls: Map controls to SOC 2 and ISO 27001, support GDPR (DPA, data subject requests, residency), collect and maintain audit evidence, and answer customer security questionnaires.
- Migration risk: Review MVP customer data migration for confidentiality, integrity and access risks.

Required Skills and Experience

- 5+ years in application and cloud security.
- Cloud security and IAM design on AWS or Azure.
- OWASP Top 10 and secure SDLC; threat modelling.
- SAST/DAST/SCA tooling in CI/CD.
- Encryption, KMS and secrets management practice.
- Working knowledge of SOC 2 or ISO 27001 controls and evidence collection.

Preferred / Added Advantage

- Kubernetes and container security (Pod Security, network policies, runtime tools).
- Pen-test coordination and remediation tracking.
- SIEM and detection engineering.
- Privacy engineering (GDPR).
- CISSP, CCSP, CISM, OSCP or cloud security certification.

Key Deliverables

- Threat models and security architecture document.
- Security controls matrix mapped to SOC 2/ISO 27001.
- CI/CD security gates and vulnerability SLA policy.
- Pen-test report with closed findings.
- Incident response plan and audit evidence pack.

Education Bachelor’s degree in Computer Science, Information Security or equivalent experience.

Pay: ₹800,000.00 - ₹1,200,000.00 per year

Work Location: In person

📌 Security Specialist (Hyderabad)
🏢 Spatial Alphabet
📍 Hyderabad