Product Security Engineer

About the role

What you'll do

• Threat-model new features before code exists: webhooks, integrations, AI agents acting on customer data.
• Find real, exploitable bugs in our code (authorisation, IDOR, injection, SSRF, races on money paths), prove them, and fix the class of bug.
• Treat tenant isolation as a property of the system and build ways to prove it holds.
• Tighten AWS IAM, network, secrets and CI/CD, with guardrails so the same issue can't ship again.
• Own identity and access: sessions, tokens, SSO and SCIM, API keys, and the credentials we hold for customers.
• Lead security incidents and build the logging that lets us find out sooner.
• Own technical controls and evidence for SOC 2 Type 2, ISO 27001, GDPR, CERT-IN, DPDPA and other applicable frameworks, working with Legal.
• Handle customer security reviews honestly, with Sales, Customer Success and Legal.
• Set the standards engineers follow when you're not in the room, and keep the team current as threats change.

Who you are

• 3 to 6 years of experience, mostly in product or application security, with hands-on engineering behind it.
• You read code in more than one language and have found exploitable bugs yourself, not only triaged scanner or bounty output.
• You have implemented least privilege in AWS or a similar cloud and lived with the result.
• You have led a real security incident and carried SOC 2, ISO 27001 or similar through an audit.
• You can name an engineer whose habits changed because of you.
• You follow specific sources and can name a recent change in the threat landscape that changed a decision of yours.

You should not apply if

• Your security experience is entirely corporate IT (endpoints, helpdesk, devices).
• You want a policy-only role, or to manage a team in your first year.
• You'd rather stay quiet than tell a colleague or founder that something they own is broken.

Good to have

• Fintech, billing or payments experience
• Offensive security background (bug bounty, OSCP or similar)
• First or only security hire before
• Security tooling you built.

Location

• Hybrid - 3 days per week
• Office Location: Indiranagar, Bengaluru.
• Address: 3rd Floor, A wing No 1, Carlton Towers, HAL Old Airport Rd, HAL 2nd Stage, Indiranagar, Bengaluru, Karnataka 560008.

Interview process

• R0, Recruiter screen (30 min): Whether their security work is recent and hands-on, and whether each claim on the CV has a real, specific story behind it, not a borrowed one.
• R1, Application security (60 min): A small billing-shaped service with four seeded bugs, from obvious to one nobody would notice for a quarter. You find them, rank them by damage, prove the worst one with an actual exploit, and fix it live.
• R2, Cloud and DevOps security (60 min): The AWS setup behind that same service. You find what’s exposed, rank it by what an attacker could actually reach, and show the call that exploits the worst issue.
• R3, Security operations, compliance and risk (60 min): A real incident you led, an audit you carried end to end, a prioritization call you made under real constraints, and a customer security question where honesty could’ve cost the deal.
• R4, Bar raiser (30 min): Whether someone is measurably better because you changed how they work without authority over them, how you’ve handled a security call from someone senior to you, and a re-probe of the weakest signal from earlier rounds.
• Reference checks: Two former direct managers, contacted by the hiring manager.