Principal Engineer - VMS I On-site, Bangalore

Overview

Senior technical leader for Exposure Management across infrastructure, cloud, applications, containers and modern technology environments, developing standards and processes to identify, assess, prioritize and reduce security exposures for internal and client environments.

What you'll do

• Provide technical leadership for Exposure Management services across infrastructure, endpoints, networks, operating systems, cloud platforms, applications, APIs, containers, Kubernetes and software dependencies.
• Define and continuously improve the end-to-end Exposure Management lifecycle covering discovery, assessment, validation, contextualization, prioritization, remediation, reporting and continuous improvement.
• Design and maintain assessment policies, security baselines, scan configurations, credentials, schedules, coverage standards and technical procedures across supported security platforms.
• Lead the identification and management of security exposures including software vulnerabilities, application weaknesses, cloud misconfigurations, insecure configurations, vulnerable dependencies, exposed services, container risks and other technology weaknesses.
• Establish risk-based prioritization methodologies considering severity, exploitability, active exploitation, asset criticality, external exposure, business impact, application context, threat intelligence and available compensating controls.
• Analyze and validate security findings to improve accuracy, eliminate false positives and duplicate findings, identify systemic risk, and ensure remediation focuses on meaningful exposures.
• Work closely with infrastructure, cloud, application, DevOps, networking, platform and security teams to translate exposure findings into actionable remediation activities.
• Provide technical leadership for enterprise security assessment technologies and capabilities including network and agent scanning, credentialed assessments, cloud posture assessment, application security testing, dependency analysis, container security, API security and Infrastructure-as-Code security.
• Support the integration of security assessments into modern engineering and DevSecOps workflows to identify and remediate exposures earlier in the technology and application lifecycle.
• Define and maintain technical integrations between Exposure Management technologies and enterprise platforms such as SIEM, SOAR, ITSM, CMDB, CI/CD, asset management and risk-management systems.
• Develop dashboards and reporting providing visibility into overall exposure, remediation progress, aging, coverage, trends, SLA performance, recurring weaknesses and risk reduction.
• Establish metrics and KPIs that measure the effectiveness and maturity of Exposure Management rather than focusing solely on vulnerability volume.
• Identify opportunities for automation and orchestration across discovery, enrichment, validation, prioritization, assignment, remediation tracking, exception management and reporting.
• Lead troubleshooting and resolution of complex issues involving scanning, integrations, assessment coverage, credentials, policies, cloud configurations, application testing, asset identification and reporting.
• Support onboarding of new clients, technologies, applications, cloud environments and security platforms into the Exposure Management service.
• Evaluate emerging Exposure Management technologies and provide technical recommendations for service enhancement and technology adoption.
• Develop and maintain engineering standards, operating procedures, runbooks, implementation guides, knowledge articles and technical documentation.
• Provide technical mentoring and knowledge transfer to engineers and analysts across infrastructure, cloud and application security disciplines.
• Serve as a senior technical advisor during client security reviews, technical workshops, escalations, architecture discussions and service improvement initiatives.
• Stay current with emerging vulnerabilities, exploitation techniques, application security risks, cloud security threats, attack-surface trends and evolving Exposure Management practices.

What you'll need

• 10+ years of relevant cybersecurity experience, with significant experience across vulnerability management, security engineering, cloud security, application security or related disciplines.
• 6+ years of hands-on experience implementing, managing or engineering enterprise security assessment and Exposure Management technologies.
• Strong understanding of the complete vulnerability and exposure lifecycle, including asset discovery, assessment, validation, risk prioritization, remediation, exception management and measurement.
• Experience assessing diverse enterprise environments including Windows, Linux/Unix, network devices, virtualized infrastructure, AWS, Microsoft Azure, containers, Kubernetes, applications, APIs and cloud workloads.
• Hands-on experience with enterprise vulnerability or exposure technologies such as Tenable, Qualys, Rapid7, Brinqa, Lumin, Nmap, or equivalent platforms.
• Experience with cloud security and posture-management technologies such as Wiz, Prisma Cloud, Microsoft Defender for Cloud, Orca Security, or equivalent CSPM/CNAPP capabilities.
• Experience with application security capabilities including SAST, DAST, Software Composition Analysis (SCA), API security, secrets detection, container scanning and Infrastructure-as-Code security.
• Strong understanding of risk-based prioritization, combining vulnerability severity with asset importance, exploitability, exposure, threat intelligence, business context and compensating controls.
• Understanding of industry security standards and frameworks including CVE, CVSS, CWE, CISA KEV, OWASP Top 10, CIS Benchmarks, NIST, ISO 27001, SOC 2 and PCI DSS.
• Experience establishing metrics and dashboards that communicate technical risk, remediation progress, coverage, service performance and security posture to technical and executive audiences.
• Experience integrating security platforms with technologies such as ITSM, SIEM, SOAR, CMDB, CI/CD, asset inventory and reporting platforms.
• Strong analytical and troubleshooting skills across complex and heterogeneous enterprise environments.
• Ability to translate large volumes of technical security findings into prioritized, actionable risk-reduction activities.
• Strong understanding of security architecture, networking, cloud architectures, modern application architectures, containers, DevOps and enterprise infrastructure.
• Demonstrated ability to lead complex technical initiatives and provide technical direction to engineers without direct management responsibility.
• Ability to foster collaborative relationships across Security, Infrastructure, Cloud, Application Development, DevOps, Architecture and business stakeholders.
• Strong client-facing communication skills, explaining technical exposure and risk to engineering and leadership audiences.
• Excellent written and verbal communication skills.

Nice to have

• Experience with application security technologies such as Checkmarx, Veracode, Snyk, GitHub Advanced Security, Black Duck, Burp Suite Enterprise or equivalent platforms.

Details

• On-site at the Bangalore office, 3 days per week.
• Location: Bangalore, Karnataka.