Security Engineer

About Finnable
Finnable is a Bangalore-based digital lending platform focused on making personal loans accessible to India’s salaried professionals — quickly, transparently, and responsibly.
The company serves the mid-income salaried segment, especially individuals who may not always have easy access to formal credit despite being disciplined borrowers. Finnable combines digital underwriting, instant approvals, and on-ground verification/collections to create a lending model that is both tech-first and operationally controlled.
Founded by Nitin Gupta and Amit Arora, both seasoned financial services and lending professionals, Finnable has scaled with strong focus on risk, collections, customer trust, and capital discipline.
Key scale markers:
₹4000 Cr AUM / ₹500 Cr equity raise led by Z47 and TVS Capital
BBB+ credit rating from CARE Ratings in its first-ever rating cycle
GNPA of 0.85%, significantly lower than broader industry averages
Profitable last year, with minimal equity burn to reach current scale
10L+ app downloads and 4.4/5 app rating
65% of customers are first-time personal loan borrowers
Ambition to serve 1M+ customers over the next 4 years and expand the loan book to ₹10,000 Cr
The company is now entering its next phase of growth — expanding products, deepening technology, strengthening risk and collections infrastructure, and building the organisation required to support a much larger lending platform
Job role: Security Engineer
Location: Bengaluru
Reports to: CISO
Role Summary
We are looking for a Security Engineer to work closely with product, engineering, DevOps, cloud, IT, and AI teams to strengthen the security of applications and technology infrastructure. The role will primarily focus on Application Security, with responsibilities across Cloud Security, AI Security, vulnerability management, DevSecOps, and Incident Response.
Key Responsibilities
Perform security reviews of product features, APIs, web applications, backend services, and AI-enabled features
Conduct threat modeling for new features, architecture changes, AI/LLM integrations, and high-risk releases
Support application security testing including SAST, DAST, dependency scanning, secrets scanning, and manual security testing
Track vulnerabilities from identification through remediation, retesting, and closure
Review authentication, authorization, session management, input validation, API security, and data protection controls
Partner with engineering teams to improve secure coding practices and integrate security checks into CI/CD pipelines
Review cloud security configurations including IAM permissions, network controls, storage access, secrets management, encryption, and logging
Support identification and remediation of cloud misconfigurations and security risks across AWS/cloud environments
Review AI/LLM implementations for risks such as prompt injection, sensitive data exposure, insecure model/API integrations, excessive permissions, and unsafe output handling
Assess security and privacy risks associated with third-party AI platforms, models, plugins, APIs, and data shared with AI services
Support secure handling of AI prompts, training/context data, credentials, model outputs, and access controls
Assist in triaging and investigating application, cloud, AI, identity, and infrastructure-related security incidents
Support incident containment, root cause analysis, corrective actions, and improvement of security controls
Review security of third-party integrations, APIs, SDKs, and product-related vendors
Support security documentation, metrics, audit evidence, and security awareness activities
Required Qualifications
2 - 3 years of experience in application security, product security, cloud security, or security engineering
Strong understanding of OWASP Top 10 and common web/API vulnerabilities
Exposure to SAST, DAST, dependency scanning, secrets scanning, or container security tools
Knowledge of authentication, authorization, sessions, tokens, and secure API design
Experience with vulnerability management and remediation tracking
Understanding of SDLC, CI/CD, DevSecOps, and secure development practices
Familiarity with AWS security services such as IAM, CloudTrail, GuardDuty, Security Hub, WAF, or AWS Config
Understanding of security risks associated with AI/LLM-based applications, including prompt injection data leakage, insecure integrations, and access-control risks
Understanding of security incident investigation, log analysis, and root cause analysis
Good analytical, communication, and stakeholder coordination skills
Preferred Qualifications
Experience with Burp Suite or similar application security testing tools
Exposure to SIEM/security monitoring and incident response tools
Familiarity with AI/LLM security concepts and frameworks such as OWASP Top 10 for LLM Applications
Exposure to security reviews of GenAI applications, AI APIs, RAG implementations, agents, or third-party AI platforms
Familiarity with secure code review and Infrastructure-as-Code security
Scripting knowledge such as Python/Bash
Experience in fintech, payments, NBFC, or regulated environments

Work arrangement
No