Junior Security Engineer
Posted
Summary
Hands-on junior security engineer at Decentro, a YC-backed banking and payments API infrastructure company in Bangalore. Day to day: testing APIs and web apps for vulnerabilities, monitoring alerts and supporting incident response, hardening AWS (IAM, secrets, network controls), running scans and patch tracking, and automating checks with Python/Bash.
About Decentro
Decentro is a Y-Combinator backed banking & payments infrastructure company. Decentro provides building blocks that help companies stitch their fintech workflows in a few weeks. While starting our first fintech venture back in 2014, we spent years convincing banks to partner with us. Before we could launch our fintech product (more here), we had to convince different departments within banks - including technology, business, leadership, legal, and support to get the green signal. Fast forward to today, we realise that banks & regulatory institutions find it difficult to help the longer tail of companies build innovative & compliant fintech solutions.
What if there was a platform (think AWS for cloud or Twilio for messaging) that abstracts the complexities of banking, identity, payments, lending, and provides simple APIs so that companies do not have to spend years dealing with banks?
We’re solving this pain point at Decentro since 2020. We’ve scaled to process $4 billion + in payment volumes & have 1400+ customers across India & Singapore in multiple verticals such as marketplaces, banks, regulated institutions, fintechs, lenders, gaming, and more.
About the role
We are looking for a hands-on Security Engineer to help secure our financial infrastructure, applications, and cloud environments. You will work closely with engineering and infrastructure teams to identify vulnerabilities, strengthen security controls, and support incident detection and response.
This is a junior-level individual contributor role for someone with prior security experience who wants to build deeper expertise in fintech, API security, and cloud security.
What is expected from you
- Test APIs and web applications for security vulnerabilities, validate findings, and collaborate with developers on remediation.
- Monitor security alerts and logs, investigate suspicious activity, and support incident response and root-cause analysis.
- Help secure AWS environments through IAM reviews, configuration checks, network controls, encryption, and secrets management.
- Run vulnerability scans, prioritise findings based on risk, and track remediation through closure.
- Own security patch tracking across servers, operating systems, containers, application dependencies, and security tooling.
- Coordinate deployment with engineering and infrastructure teams, validate fixes, and track patch compliance and exceptions.
- Support security reviews of new features and integrations, focusing on authentication, authorisation, and sensitive-data handling.
- Integrate security checks into development workflows, including dependency scanning, static analysis, and secret detection.
- Write scripts to automate repetitive security checks and improve monitoring.
- Maintain security documentation, incident playbooks, and evidence for audits and assessments.
What we are looking for
- 2–3 years of total professional experience, including hands-on experience in security engineering, application security, cloud security, SOC, or VAPT.
- Practical understanding of common application and API vulnerabilities, including broken access controls, injection, authentication flaws, and security misconfigurations.
- Familiarity with Burp Suite, OWASP ZAP, Nmap, or equivalent security-testing tools.
- Working knowledge of Linux, networking, HTTP/TLS, and cloud security fundamentals.
- Experience investigating security findings and documenting their impact, reproduction steps, and recommended fixes.
- Basic scripting skills in Python, Bash, or a similar language.
- An ownership mindset, attention to detail, and the ability to collaborate effectively with developers.
- Exposure to AWS security services, SIEM tools, endpoint security, or container security is good to have.
- Experience with CI/CD security tooling, SAST, DAST, or software composition analysis is good to have.
- Familiarity with fintech or payments environments and frameworks such as ISO 27001, SOC 2, or PCI DSS is an added advantage.
- Relevant certifications, responsible disclosures, bug bounty findings, or security projects demonstrating practical skills are an added advantage.
- Prior professional, hands-on security experience is mandatory. Certifications or coursework alone will not meet this requirement.
What We Offer
- The ability to make an impact and lay the foundation for upcoming fintech innovations. A multicultural and diverse team with colleagues from different states and global backgrounds.
- Progressive and flexible work hours that match your personality and lifestyle. Best-in-class perks and benefits.
- Check out our careers page for the same: Backed by global investors such as Y Combinator & Rapyd, we're a contrarian and progressive culture of independent thinkers and systematic executors driven to build cool things that matter.
If this aligns with you, time to hop on!
We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, colour, religion, sex, disability status, or any other characteristic protected by law.