About the role
You will be our first dedicated security engineer, accountable for three questions: is this system safe to hand a customer's revenue data to, would we know if it wasn't, and can we prove it to an auditor or enterprise buyer without inventing anything? It's a hands-on individual contributor role. Your Manager reviews your work.
What you'll do
- Threat-model new features before code exists: webhooks, integrations, AI agents acting on customer data.
- Find real, exploitable bugs in our code (authorisation, IDOR, injection, SSRF, races on money paths), prove them, and fix the class of bug.
- Treat tenant isolation as a property of the system and build ways to prove it holds.
- Tighten AWS IAM, network, secrets and CI/CD, with guardrails so the same issue can't ship again.
- Own identity and access: sessions, tokens, SSO and SCIM, API keys, and the credentials we hold for customers.
- Lead security incidents and build the logging that lets us find out sooner.
- Own technical controls and evidence for SOC 2 Type 2, ISO 27001, GDPR, CERT-IN, DPDPA and other applicable frameworks, working with Legal.
- Handle customer security reviews honestly, with Sales, Customer Success and Legal.
- Set the standards engineers follow when you're not in the room, and keep the team current as threats change.
Who you are
- 3 to 6 years of experience, mostly in product or application security, with hands-on engineering behind it.
- You read code in more than one language and have found exploitable bugs yourself, not only triaged scanner or bounty output.
- You have implemented least privilege in AWS or a similar cloud and lived with the result.
- You have led a real security incident and carried SOC 2, ISO 27001 or similar through an audit.
- You can name an engineer whose habits changed because of you.
- You follow specific sources and can name a recent change in the threat landscape that changed a decision of yours.
You should not apply if
- Your security experience is entirely corporate IT (endpoints, helpdesk, devices).
- You want a policy-only role, or to manage a team in your first year.
- You'd rather stay quiet than tell a colleague or founder that something they own is broken.
Good to have
- Fintech, billing or payments experience
- Offensive security background (bug bounty, OSCP or similar)
- First or only security hire before
- Security tooling you built.
Location
- Hybrid - 3 days per week
- Office Location: Indiranagar, Bengaluru.
- Address: 3rd Floor, A wing No 1, Carlton Towers, HAL Old Airport Rd, HAL 2nd Stage, Indiranagar, Bengaluru, Karnataka 560008.
Interview processOur process is structured and evidence-based. No single round exceeds 60 minutes, and every round is scored against a defined set of capabilities rather than general impressions.
Please Note: No AI assistance in the technical rounds.
- R0, Recruiter screen (30 min): Whether their security work is recent and hands-on, and whether each claim on the CV has a real, specific story behind it, not a borrowed one.
- R1, Application security (60 min): A small billing-shaped service with four seeded bugs, from obvious to one nobody would notice for a quarter. You find them, rank them by damage, prove the worst one with an actual exploit, and fix it live.
- R2, Cloud and DevOps security (60 min): The AWS setup behind that same service. You find what’s exposed, rank it by what an attacker could actually reach, and show the call that exploits the worst issue.
- R3, Security operations, compliance and risk (60 min): A real incident you led, an audit you carried end to end, a prioritization call you made under real constraints, and a customer security question where honesty could’ve cost the deal.
- R4, Bar raiser (30 min): Whether someone is measurably better because you changed how they work without authority over them, how you’ve handled a security call from someone senior to you, and a re-probe of the weakest signal from earlier rounds.
- Reference checks: Two former direct managers, contacted by the hiring manager.