Senior Engineer- Security Research

About Indusface:

Indusface protects thousands of business-critical web, API and AI applications across 45+ countries. Backed by leading institutional investors, Indusface has been featured in research by Gartner, Forrester and IDC for its application security capabilities. The company maintains globally recognized security and compliance credentials, including ISO 27001, SOC 2 and PCI DSS, and supports GDPR-related requirements. Its globally distributed cloud infrastructure spans Asia, the Middle East, Europe and North America, delivering low-latency protection and regional data residency options for enterprises worldwide.

AppTrana is Indusface's autonomous enterprise application security platform that continuously discovers vulnerabilities, autonomously mitigates exploitable risks through virtual patching, and protects applications against DDoS attacks, malicious bots, API abuse and zero-day threats. Combining AI-powered intelligence, expert oversight and SLA-backed managed protection, AppTrana helps enterprises reduce the time from vulnerability discovery to protection while delivering audit-ready remediation evidence and managed security services focused on eliminating false positives.

Indusface’s Product Suite:

• AppTrana WAAP Platform - AI-Powered, Fully Managed Application and API Protection.
• Indusface WAS Platform - Fully Managed DAST Platform for Website, Mobile App & API Vulnerability Scanning.
• SSL/VMC Certificates - Secure your online digital communication and build customer trust.

Why Join Us?

• Be part of a Market Leader - Work with an industry-recognized cybersecurity company trusted by global enterprises.
• Shape the Future - Play a pivotal role in driving innovation, partnerships, and revenue growth.
• Fast-Paced Growth - Thrive in an agile, high-growth environment with opportunities to make a real impact.
• Collaborate with the Best - Work alongside industry experts and thought leaders.
• Rewards & Recognition - Competitive salary, performance-based incentives, and clear career growth pathways

Responsibilities:

• Create signatures for Indusface WAS & WAF product to detect & protect Web applications vulnerabilities.
• Research evolving web attacks, CVEs, and evasion techniques targeting web apps and APIs and generate detection logic based on real-world payloads and tools.
• Build behaviour-based logic, anomaly scoring, and payload inspection for advanced threats.
• Design and prototype new WAF product security features such as: Bot, DDOS, WAAP, etc.
• Outstanding problem solving and troubleshooting skills are a must, as solutions to many problems might not be obvious.
• Drive the end-to-end release process for WAF detection updates and product features.
• Coordinate with DevOps/Release teams to validate rollout on staging and production.
• Monitor post-release impact and lead fixes for regressions or tuning issues.
• Trouble-shooting customer cases & provide timely solutions and write RCAs wherever necessary.
• Developing Security tools, automation to ease manual/repeated work to increase efficiency in providing the solution.

Candidate Profile:

5-10 years of vulnerability analysis, research and developing IPS/IDS/WAF signature writing experience.

Good understanding of:

• Firewalls, proxies, SIEM, antivirus, and IDPS concepts
• Windows & Linux operating systems (REDHAT)
• Network security, network layers (OSI Layer-3 and Layer-4)
• Protocols like TCP/IP, DNS, HTTP, HTTPS, SSH etc.
• Network Penetration testing and techniques
• Identify and mitigate network vulnerabilities and explain how to prevent them
• Programming languages like C/C++ or Python

Hands-on experience in:

• Research on zero days,  critical vulnerabilities, exploits in wild, discover new vulns
• Web-app security  (SQL Injection, XSS, CSRF etc.), OWASP-10, SANS Top 25
• Network analysis tools like tcp dump, Wireshark, Burp suite and assisting tools like Debuggers, Hex Editors, etc.
• Crafting Regular Expressions, Verification & Validation
• Vulnerability scanners, IDS/IPS, Application Firewall, VAPT tools: Metasploit, Nessus, etc.
• Analysing existing or writing new POCs
• DOS attacks, Bot attacks, API based attacks & its exploitation/testing tools
• Experience with ML-assisted detection or behavioural security models
• Contributions to open-source security tools or research publications
• Certifications (e.g., OSWE, GWAPT, CEH, CISSP) are a plus
• Effective written and verbal communication skills.