Platform Security Engineer (VAPT & Infra)

The Role
We are looking for a Security Engineer to own vulnerability assessment and penetration testing across our web applications, APIs, networks and cloud infrastructure. The role has two sides: offensive testing to find and validate weaknesses, and defensive assurance to keep our cloud estate hardened, compliant and fully patched.
Our platform runs primarily on Oracle Cloud Infrastructure (OCI), so hands-on OCI security experience matters. You will work with Burp Suite Professional and a strong open-source toolchain, turn findings into prioritized fixes, and work with development and infrastructure teams to close them.
What You Will Do
Security Testing
Plan and run VAPT engagements across web apps, APIs, internal and external networks, and cloud-hosted workloads
Identify, exploit and validate vulnerabilities through manual testing, supported by Burp Suite Professional and open-source tools
Assess Linux and containerized environments for security gaps
Test against OWASP Top 10, OWASP API Security Top 10, OWASP ASVS and MITRE ATT&CK
Retest after remediation to confirm vulnerabilities are fully closed
Cloud Security (OCI)
Continuously assess OCI tenancies for misconfigurations across IAM policies, compartments, security lists, network security groups, WAF, load balancers, Object Storage and Vault/KMS
Run and tune Cloud Guard, Security Zones, Vulnerability Scanning Service, Bastion, Audit and Logging Analytics, and act on what they detect
Review Terraform and OCI Resource Manager code for insecure defaults before changes reach production
Harden OKE clusters, container images and registries with the DevOps team
Vulnerability and Patch Management
Own the vulnerability lifecycle end to end: discovery, triage, risk rating, assignment, tracking and verification
Run regular authenticated and unauthenticated scans across servers, endpoints, container images and cloud services
Make sure systems are patched within severity-based SLAs, and escalate overdue items
Maintain an accurate asset inventory so nothing falls outside scanning and patching scope
Compliance and Hardening
Keep cloud and on-premises infrastructure aligned to CIS Benchmarks (OCI, Linux, Kubernetes) and OCI security best practices
Run configuration reviews, track deviations and drive them to remediation
Support ISO 27001, SOC 2 and PCI-DSS through control mapping, evidence collection and audit responses
Contribute to hardening guides and secure configuration standards
Reporting and Collaboration
Write clear technical and executive reports with risk ratings, business impact and practical fixes
Track security posture, open vulnerabilities by severity, patch SLA adherence and audit readiness for management
Stay current on new threats, CVEs and tooling relevant to our stack
Keep all testing within authorized scope and company policy
What You Bring
3 to 5 years in a Security Engineer, Security Analyst or Penetration Tester role, including 2+ years securing public cloud
Working knowledge of OCI security services and controls
Proven ability to test and exploit web and API flaws: injection, broken access control, authentication and session issues, SSRF, deserialization and business logic abuse
Strong Linux and Windows fundamentals, Active Directory security concepts, and container and Kubernetes security
Hands-on ownership of scanning, triage and patch verification against SLAs
Familiarity with CIS Benchmarks, CVSS, CWE and CVE, plus exposure to ISO 27001, SOC 2 or PCI-DSS
Scripting in Python, Bash or PowerShell
Clear writing, and the ability to explain risk to engineers and executives alike
Our Toolchain
We get commercial-grade results with Burp Suite Professional plus open-source and cloud-native tools. You should be comfortable working without licensed scanners.
Web and API: Burp Suite Pro, OWASP ZAP, Nuclei, SQLMap, ffuf
Network: Nmap, Metasploit, Wireshark, Impacket
Scanning: OpenVAS / Greenbone, OCI Vulnerability Scanning Service
Cloud posture: Prowler, ScoutSuite, Cloud Guard
Containers: Trivy, Grype, kube-bench
Hardening: OpenSCAP, Lynis
Code and secrets: Semgrep, Gitleaks, TruffleHog
Recon: Amass, Subfinder
Nice to Have
OCI certification (Foundations, Architect Associate or Security Professional)
OSCP or CEH
DevSecOps exposure: SAST, DAST, SCA and secrets scanning in CI/CD
Who You Are
Structured and evidence-driven. You own problems until they are closed, even when that means chasing fixes across teams. You handle sensitive findings with discretion and high ethical standards.

Skills
Python, Linux, Kubernetes, CI/CD, Terraform, Manual Testing

Work arrangement
No