3 months ago
Hyderābād, IndiaMid Level
Responsibilities
- Guide technology organization security and privacy initiatives through design reviews and threat modeling.
- Ensure web and mobile applications are secured and hardened throughout the project lifecycle.
- Define project scope and ensure continuous adherence from initiation through maintenance.
- Create visibility and adoption for security projects serving internal customers.
- Act as a security engineering expert and technical champion within Zeta.
- Assess application security gaps and identify tools and improvements.
- Coordinate with internal and external stakeholders.
- Mentor developers and QA teams on security practices.
- Evaluate vulnerabilities reported through bug bounty programs.
- Assess the security posture of applications across business units.
- Drive continuous improvement of web and mobile application security.
- Conduct quarterly internal and external, authenticated and unauthenticated vulnerability assessments and penetration tests.
- Secure the configuration of web and mobile applications, databases, data, cloud infrastructure, and servers.
Requirements
- Hands-on vulnerability assessment and penetration testing experience across web, mobile, SDK, API, and network environments.
- Thorough understanding of the OWASP Top 10, attack and defense mechanisms, threat modeling, secure coding, and secure SDLC activities.
- Experience with commercial and open-source security tools including Burp Suite, AppScan, OWASP ZAP, BeEF, Metasploit, Qualys, Nessus, Snyk, Veracode, Checkmarx, and SonarQube.
- Ability to identify and exploit business-logic vulnerabilities and incorrect configurations.
- Understanding of cryptography, PKI-based systems, TLS, authentication and authorization frameworks, and payment key management.
- Experience reversing mobile applications and using tools such as Dex2jar, adb, Drozer, Clang, iMAS, Frida, and Objection.
- Experience conducting security assessments and penetration tests in Windows, Linux, and AWS environments.
- Shell scripting or automation experience using Python or Ruby.
- Knowledge of PA-DSS, PCI SSF, PCI DSS, UIDAI, GDPR, and NIST security standards.
- Ability to read, write, and understand Java code and familiarity with Spring Boot, Jenkins, CI/CD, and production operations on public cloud infrastructure.
- Knowledge of AWS, Azure, Docker, containers, Kubernetes, databases, data stores, and Cloudflare WAF.
- Participation in bug bounty programs and experience conducting hackathons or CTFs.
- OSCP, GWAPT, AWAE, or CompTIA Security+ certifications are relevant, with OSCP preferred.
- Bachelor of Technology, BE/B.Tech, M.Tech, or ME in Computer Science or an equivalent qualification from a Tier-1 engineering college or university.
- At least 4 years of experience developing large-scale internet or SaaS applications and 2 to 3 years of experience as a web/mobile application security engineer or developer.
- FinTech experience and knowledge of HSM operations are desirable.
Tech Stack
Amazon RedshiftAWSAzureCloudflareDockerElasticsearchJavaJenkinsKubernetesLinuxMySQLPostgreSQLPythonRubySonarQubeSpring BootWindows
Categories
About Zeta
Zeta builds a cloud‑native, API‑first banking platform that covers issuer processing, core banking, and digital banking for banks, credit unions, and fintechs. It sells enterprise software and services that help institutions launch and manage cards, loans, and deposit products. Founded in 2015 and headquartered in San Francisco, the privately held company powers programs across multiple countries, with customers having issued over 25 million cards on its platform.