Product Security Engineer

About the role Zenskar is a multi-tenant billing and revenue platform. We hold our customers' contracts, invoices and usage data, along with their credentials to Stripe, QuickBooks and other systems. Every enterprise buyer asks the same question: can we trust you with this? You will be our first dedicated security engineer, accountable for three questions: is this system safe to hand a customer's revenue data to, would we know if it wasn't, and can we prove it to an auditor or enterprise buyer without inventing anything? It's a hands-on individual contributor role. Your Manager reviews your work. What you'll do Threat-model new features before code exists: webhooks, integrations, AI agents acting on customer data. Find real, exploitable bugs in our code (authorisation, IDOR, injection, SSRF, races on money paths), prove them, and fix the class of bug. Treat tenant isolation as a property of the system and build ways to prove it holds. Tighten AWS IAM, network, secrets and CI/CD, with guardrails so the same issue can't ship again. Own identity and access: sessions, tokens, SSO and SCIM, API keys, and the credentials we hold for customers. Lead security incidents and build the logging that lets us find out sooner. Own technical controls and evidence for SOC 2 Type 2, ISO 27001, GDPR, CERT-IN, DPDPA and other applicable frameworks, working with Legal. Handle customer security reviews honestly, with Sales, Customer Success and Legal. Set the standards engineers follow when you're not in the room, and keep the team current as threats change. Who you are 3 to 6 years of experience, mostly in product or application security, with hands-on engineering behind it. You read code in more than one language and have found exploitable bugs yourself, not only triaged scanner or bounty output. You have implemented least privilege in AWS or a similar cloud and lived with the result. You have led a real security incident and carried SOC 2, ISO 27001 or similar through an audit. You can name an engineer whose habits changed because of you. You follow specific sources and can name a recent change in the threat landscape that changed a decision of yours. You should not apply if Your security experience is entirely corporate IT (endpoints, helpdesk, devices). You want a policy-only role, or to manage a team in your first year. You'd rather stay quiet than tell a colleague or founder that something they own is broken. Good to have Fintech, billing or payments experience Offensive security background (bug bounty, OSCP or similar) First or only security hire before Security tooling you built. Location Hybrid - 3 days per week Office Location: Indiranagar, Bengaluru. Address: 3rd Floor, A wing No 1, Carlton Towers, HAL Old Airport Rd, HAL 2nd Stage, Indiranagar, Bengaluru, Karnataka 560008. Interview process Our process is structured and evidence-based. No single round exceeds 60 minutes, and every round is scored against a defined set of capabilities rather than general impressions. Please Note: No AI assistance in the technical rounds. R0, Recruiter screen (30 min): Whether their security work is recent and hands-on, and whether each claim on the CV has a real, specific story behind it, not a borrowed one. R1, Application security (60 min): A small billing-shaped service with four seeded bugs, from obvious to one nobody would notice for a quarter. You find them, rank them by damage, prove the worst one with an actual exploit, and fix it live. R2, Cloud and DevOps security (60 min): The AWS setup behind that same service. You find what’s exposed, rank it by what an attacker could actually reach, and show the call that exploits the worst issue. R3, Security operations, compliance and risk (60 min): A real incident you led, an audit you carried end to end, a prioritization call you made under real constraints, and a customer security question where honesty could’ve cost the deal. R4, Bar raiser (30 min): Whether someone is measurably better because you changed how they work without authority over them, how you’ve handled a security call from someone senior to you, and a re-probe of the weakest signal from earlier rounds. Reference checks: Two former direct managers, contacted by the hiring manager. We'll share detailed feedback and next steps promptly after each round.