Founding Security Engineer (Product Security)

Your Role:

• You'll own security across all of our products. With a large engineering team shipping daily, that means building secure defaults and tooling that scale rather than reviewing everything by hand — security that's automatic, continuous and owned. It's a high-ownership role with significant independence, and you'll succeed by partnering closely with engineering teams.
• Enforce server-side authorization; defend against account takeover, promo abuse, payment tampering, and content piracy.
• Secure our mobile and AI surfaces, and keep children's, health, and payment data least-privilege and audited.
• Make SAST, DAST, SCA and secret scanning default in CI/CD, and keep results trustworthy so engineers act on them.
• Own our cloud posture — VPCs, security groups, IAM, secrets management, and threat detection.
• Run vulnerability management — the VAPT cadence and a channel for outside researchers to report issues and see fixes through.
• Build security incident management end to end, detection to postmortem, against India's short breach-reporting clock.
• Build Seekho's security platform — the internal libraries and guardrails engineers build on.

Must Have:

• 4+ years in security, with real depth in application and API security.
• You think in terms of how systems get exploited, not just vulnerability categories.
• You can explain an authorization flaw in unfamiliar code, and code in Python or Go to build tooling.
• Working knowledge of cloud security — IAM, secrets, network controls, and threat detection.
• You've found real vulnerabilities yourself — a bounty, a VAPT finding, a CVE, or in your own product.
• Practical incident management, detection through postmortem — you've worked a real incident, not just written the plan.
• You've owned security in-house for a shipping product, as the first or only security person.

Bonus: