Responsibilities

<ul>
<li>Guide the technology organization's security and privacy initiatives by participating in design reviews and threat modeling.</li>
</ul>

<ul>
<li>The applications are developed by the developers and product managers, and you will make sure the applications are secured and hardened.</li>
</ul>

<ul>
<li>You will define the scope and ensure continuous adherence to the scope of projects at each phase (initiation to sustenance/maintenance phase).</li>
</ul>

<ul>
<li>You will be responsible for creating visibility, and adoption of the projects meant for internal customers.</li>
</ul>

<ul>
<li>Act as a security engineering expert and technical champion within Zeta.</li>
</ul>

<ul>
<li>Assess gaps, and tools to improve application security</li>
</ul>

<ul>
<li>Liasioning with all external and internal stakeholders for the team.</li>
</ul>

<ul>
<li>Mentoring developers and QA.</li>
</ul>

<ul>
<li>Evaluate bugs reported through the Bug Bounty program.</li>
</ul>

<ul>
<li>Run security posture of various applications across BU’s.</li>
</ul>

<ul>
<li>Continuous improvement of web/mobile application security</li>
</ul>

<ul>
<li>Quarterly VA/PT (internal/external, authenticate/non-authenticated) for mobile/web.</li>
</ul>

<ul>
<li>Secure configuration of Web/Mobile application, DB, Data etc.</li>
</ul>

Skills

<ul>
<li>Hands on VA/PT experience in Web, Mobile, API &amp; Network</li>
</ul>

<ul>
<li>Thorough understanding of OWASP Top 10, their attack &amp; defence mechanisms</li>
</ul>

<ul>
<li>Exposure to Secure SDLC Activities, Threat Modelling &amp; Secure Coding</li>
</ul>

<ul>
<li>Experience on both commercial and open source tools like Burpsuite, AppScan, OWASP ZAP, BEEF, MetaSploit, Qualys, Nessus, Synk etc.</li>
</ul>

<ul>
<li>Identifying &amp; exploiting business logic-related vulnerabilities.</li>
</ul>

<ul>
<li>Solid understanding of Cryptography, knowledge of PKI-based systems, TLS</li>
</ul>

<ul>
<li>Understanding of different AuthN/AuthZ frameworks (OIDC, oAuth, SAML) able to read/write/understand java code</li>
</ul>

<ul>
<li>Performed Static Analysis, Code reviews using tools like Snyk, Veracode, Checkmarx, Sonarqube etc.</li>
</ul>

<ul>
<li>Hands on Reversing mobile applications, class/small files, data obfuscators, or ciphers (Dex2jar, adb, Drozer, Clang, iMAS) and Dynamic Instrumentation tools like Frida/Objection</li>
</ul>

<ul>
<li>Execute penetration tests and security assessments on internal and external networks, Windows and Linux environments, cloud (AWS) Infrastructure.</li>
</ul>

<ul>
<li>Identify and exploit incorrect configurations and security vulnerabilities on Windows and Linux servers. Safely utilize tools, tactics, and procedures used in penetration testing engagements.</li>
</ul>

<ul>
<li>Shell scripting or automation of simple tasks using Python, or Ruby</li>
</ul>

<ul>
<li>Knowledge of PA-DSS, PCI SSF (S3, SSLC) etc.</li>
</ul>

<ul>
<li>Knowledge of security standards like PCI DSS, UIDAI, GDPR, NIST etc.</li>
</ul>

<ul>
<li>Understanding of Java Frameworks like Springboot, CI/CD, Jenkins.</li>
</ul>

<ul>
<li>In-depth understanding of production operations on public cloud infrastructure.</li>
</ul>

<ul>
<li>Excellent written and oral communication and a penchant for technical documentation.</li>
</ul>

<ul>
<li>Must have participated in various bug bounty programs (HackerOne, Bug Crowd, Private etc)</li>
</ul>

<ul>
<li>Experience in conducting hackathons and CTF’s</li>
</ul>

<ul>
<li>Knowledge of AWS/Azure (VPC/Vnet, S3 buckets, blob stores, LoadBalancers etc.), Dockers &amp; Containers, Kubernetes</li>
</ul>

<ul>
<li>Good understanding of agile development practices.</li>
</ul>

<ul>
<li>Certifications like OSCP(Preferred), GWAPT, Advanced Web Attacks and Exploitation (AWAE), Comptia Security+</li>
</ul>

<ul>
<li>Knowledge of Databases - Postgresql, Redshift, My SQL etc. and other data stores like Elasticsearch and S3 buckets.</li>
</ul>

Experience and Qualifications

<ul>
<li>2+ years of experience in developing large scale internet or SaaS applications.</li>
</ul>

<ul>
<li>2 to 3 years of overall experience as Web/Mobile Application Security engineer or Developer in medium to large-sized product companies. · Bachelor of Technology (BE/B.Tech), M.Tech or ME in Computer Science or equivalent from a Tier-1 engineering college/university</li>
</ul>

Security Engineer

India

Responsibilities Guide the technology organization's security and privacy initiatives by participating in design reviews and threat modeling. The applications are developed by the developers and product managers, and you will make sure the applications are secured and hardened. You will define the scope and ensure continuous adherence to the scope of projects at each phase (initiation to sustenance/maintenance phase). You will be responsible for creating visibility, and adoption of the projects meant for internal customers. Act as a security engineering expert and technical champion within Zeta. Assess gaps, and tools to improve application security Liasioning with all external and internal stakeholders for the team. Mentoring developers and QA. Evaluate bugs reported through the Bug Bounty program. Run security posture of various applications across BU’s. Continuous improvement of web/mobile application security Quarterly VA/PT (internal/external, authenticate/non-authenticated) for mobile/web. Secure configuration of Web/Mobile application, DB, Data etc. Skills Hands on VA/PT experience in Web, Mobile, API &amp; Network Thorough understanding of OWASP Top 10, their attack &amp; defence mechanisms Exposure to Secure SDLC Activities, Threat Modelling &amp; Secure Coding Experience on both commercial and open source tools like Burpsuite, AppScan, OWASP ZAP, BEEF, MetaSploit, Qualys, Nessus, Synk etc. Identifying &amp; exploiting business logic-related vulnerabilities. Solid understanding of Cryptography, knowledge of PKI-based systems, TLS Understanding of different AuthN/AuthZ frameworks (OIDC, oAuth, SAML) able to read/write/understand java code Performed Static Analysis, Code reviews using tools like Snyk, Veracode, Checkmarx, Sonarqube etc. Hands on Reversing mobile applications, class/small files, data obfuscators, or ciphers (Dex2jar, adb, Drozer, Clang, iMAS) and Dynamic Instrumentation tools like Frida/Objection Execute penetration tests and security assessments on internal and external networks, Windows and Linux environments, cloud (AWS) Infrastructure. Identify and exploit incorrect configurations and security vulnerabilities on Windows and Linux servers. Safely utilize tools, tactics, and procedures used in penetration testing engagements. Shell scripting or automation of simple tasks using Python, or Ruby Knowledge of PA-DSS, PCI SSF (S3, SSLC) etc. Knowledge of security standards like PCI DSS, UIDAI, GDPR, NIST etc. Understanding of Java Frameworks like Springboot, CI/CD, Jenkins. In-depth understanding of production operations on public cloud infrastructure. Excellent written and oral communication and a penchant for technical documentation. Must have participated in various bug bounty programs (HackerOne, Bug Crowd, Private etc) Experience in conducting hackathons and CTF’s Knowledge of AWS/Azure (VPC/Vnet, S3 buckets, blob stores, LoadBalancers etc.), Dockers &amp; Containers, Kubernetes Good understanding of agile development practices. Certifications like OSCP(Preferred), GWAPT, Advanced Web Attacks and Exploitation (AWAE), Comptia Security+ Knowledge of Databases - Postgresql, Redshift, My SQL etc. and other data stores like Elasticsearch and S3 buckets. Experience and Qualifications 2+ years of experience in developing large scale internet or SaaS applications. 2 to 3 years of overall experience as Web/Mobile Application Security engineer or Developer in medium to large-sized product companies. · Bachelor of Technology (BE/B.Tech), M.Tech or ME in Computer Science or equivalent from a Tier-1 engineering college/university

Security Engineer · Delhi

Job highlights

Skillset required

Job Description

Job Description for Security Engineer

More at Zeta