Product Security Engineer

Overview

Product Security Engineer for a SaaS security team, embedded with product and engineering to proactively find and fix vulnerabilities.

What you'll do

• Actively test the SaaS product for security vulnerabilities across web apps, APIs, and cloud infrastructure.
• Run manual security testing and targeted penetration tests beyond automated scanners.
• Implement automated security test suites.
• Identify abuse cases, business logic flaws, and real-world attack paths.
• Work with engineers to reproduce issues and drive fixes.
• Help introduce lightweight security practices such as threat modeling and secure design reviews.
• Validate fixes to ensure issues are fully resolved.

What you'll need

• 8+ years of experience in application security, offensive security, or penetration testing.
• Strong understanding of web and API security including OWASP Top 10, auth, sessions, and access control.
• Experience testing modern SaaS products.
• Comfort working in cloud environments (AWS / GCP / Azure).
• Experience with security testing tools such as Burp Suite and Nuclei.
• Ability to communicate findings clearly to engineers.
• Self-starter mindset with high ownership and limited process.

Nice to have

• Startup or early-stage product experience.
• Bug bounty or responsible disclosure experience.
• Secure code review experience in any major language.
• Familiarity with CI/CD and modern SDLC security.
• Offensive security certifications such as OSCP or GWAPT.

Details

• Location: Bangalore, India.