Senior Security Engineer – Vulnerability Management & Penetration Testing

We are looking for a Senior Security Engineer to drive vulnerability management and penetration testing across applications and infrastructure. This role is focused on hands-on identification, validation, and remediation of security issues, with an emphasis on building scalable processes and improving overall security posture.

Responsibilities

Own and operate the vulnerability management lifecycle; Continuous scanning (applications, infrastructure, dependencies); Risk-based prioritization; Tracking and driving remediation; Perform penetration testing on web applications, APIs, and cloud environments; Validate and triage vulnerabilities to eliminate false positives and ensure actionable findings; Partner with engineering teams to fix vulnerabilities and prevent recurrence; Implement and manage tools for SAST, DAST, and dependency scanning; Infrastructure and container scanning; Develop repeatable testing methodologies and automation; Conduct adversarial testing and exploit validation to simulate real-world attack scenarios; Track metrics and report on risk posture and remediation progress; Contribute to improving secure development practices based on findings

Requirements

5–9+ years of experience in security engineering, vulnerability management, or penetration testing; Hands-on experience with: Web and API security testing; Common vulnerabilities (OWASP Top 10, misconfigurations, auth flaws); Strong understanding of attack techniques and exploitation methods; Experience with security scanning tools and frameworks; Ability to analyze and validate vulnerabilities in real-world systems; Familiarity with cloud environments (Azure preferred); Strong hands-on tester and problem solver; Ability to go beyond tools and think like an attacker; Focus on impact-driven security, not just findings

Nice to have

Experience with automating security testing in CI/CD pipelines; Familiarity with container and Kubernetes security; Experience with bug bounty or red teaming; Relevant certifications (e.g., OSCP, CEH, GWAPT)