Security Engineer – VAPT & Remediation

THE ROLE We are looking for a Security Engineer with strong software development and application security experience. This is a development-first security role, with approximately 70% focus on vulnerability remediation, secure coding, automation, and engineering, and 30% focus on security testing of web applications and APIs. The ideal candidate will be hands-on in fixing vulnerabilities directly in application code, upgrading vulnerable dependencies, building security automation, and strengthening application and infrastructure security.

About Sonata Software

SONATA SOFTWARE Sonata Software is an AI-first modernization engineering company that helps enterprises transform legacy systems into intelligent, scalable business platforms.

Powered by its Platformation™ framework and platform, Sonata delivers AI-led modernization across cloud, data, AI, Dynamics, test automation, and managed services.

Headquartered in Bengaluru, India, Sonata has more than $1.2 billion in revenue and 6,400+ AI engineers supporting global delivery across the US, UK, India, Malaysia, Mexico, Australia, DACH, and the Nordics.

With deep partnerships across Microsoft, AWS, Salesforce, and Snowflake, Sonata helps Fortune 500 enterprises accelerate innovation, improve efficiency, and drive sustainable growth.

For more information, please visit .

Responsibilities

• The candidate will own vulnerabilities end to end, from identification and root-cause analysis to remediation, testing, and closure.
• Identify and remediate security vulnerabilities directly in application code across different programming languages and frameworks.
• Fix root causes by implementing secure validation, output encoding, parameterized queries, and robust authorization controls.
• Upgrade vulnerable libraries, frameworks, and third-party components while resolving compatibility issues and maintaining build stability.
• Develop internal security tools and automation for vulnerability scanning, triage, reporting, and prevention.
• Integrate SAST, DAST, and SCA tools, such as Aikido, into CI/CD pipelines and optimize rules to reduce false positives.
• Remediate infrastructure and configuration vulnerabilities involving web servers, TLS, cloud IAM, network security, containers, Kubernetes, Infrastructure as Code, and CI/CD pipelines.
• Raise pull requests for security fixes across teams and drive changes through review, testing, and merging.
• Conduct VAPT and security testing of web applications and APIs to identify exploitable vulnerabilities.
• Perform code and design reviews covering authentication, authorization, session management, data flows, and secrets management.
• Run and tune vulnerability scans across applications, hosts, and cloud environments.
• Prioritize vulnerabilities based on exploitability, business impact, and CVSS severity.
• Retest vulnerabilities and validate remediation before closing findings.
• Write clear security reports documenting reproduction steps, evidence, risk ratings, root causes, and remediation details.
• Collaborate with engineering teams to establish remediation timelines and promote secure coding practices.
• Strong understanding of common application vulnerabilities, including OWASP Top 10.
• Experience reviewing authentication, authorization, session management, input validation, and data protection mechanisms.
• Ability to validate findings, reproduce vulnerabilities, and verify remediation.
• Infrastructure & Cloud Security Understanding of web server security, TLS configuration, cloud IAM, and network security.

Requirements

• & REQUIRED SKILLS Application Development & Remediation Strong software development experience with the ability to fix vulnerabilities across different programming languages and frameworks.
• Experience in secure coding, code refactoring, debugging, and root-cause analysis.
• Ability to upgrade vulnerable dependencies and resolve breaking changes.
• Experience writing automated tests to validate security fixes.
• Security & VAPT Hands-on experience in web application and API security testing.
• Tools & Automation Experience with SAST, DAST, and SCA tools.
• Ability to build automation scripts for vulnerability scanning, triage, reporting, and remediation tracking.
• Experience identifying and fixing vulnerabilities in Docker, Kubernetes, and Infrastructure as Code configurations.
• Reporting & Collaboration Ability to document security findings with clear reproduction steps, evidence, impact, and remediation recommendations.
• Strong problem-solving and communication skills.
• Ability to collaborate with engineering teams and drive security fixes through successful deployment.
• MANDATORY SKILLS- Software Development, Application Security, VAPT, Vulnerability Remediation, Secure Coding, SAST / DAST / SCA, Web Application & API Security, CI/CD Security.

Preferred

• Familiarity with tools such as Aikido or equivalent application security platforms.
• Experience integrating security tools into CI/CD pipelines.
• Knowledge of CI/CD pipeline security and configuration hardening.
• SKILLS- Aikido, OWASP Top 10, Security Automation, Cloud Security, AWS / Azure, Docker, Kubernetes, Infrastructure as Code, Dependency Management, Vulnerability Management, Automated Security Testing.

Job Description

Job Title- Security Engineer – VAPT & Remediation Location- Pune | Hybrid Qualifications- Experience: 5+ Years Development: 70% Security Testing: 30% Primary Skills- Application Security, VAPT, Vulnerability Remediation, Secure Coding, SAST / DAST / SCA, CI/CD Security, Web Application & API Security.