5-10

Senior Security Engineer

11/17/2025

The candidate will be responsible for addressing cloud vulnerabilities, automating security processes, conducting offensive cloud security drills, and devising rules to detect and remediate vulnerabilities in Kubernetes, AWS, and IAM. They will collaborate with other security teams to maintain and improve the company's overall security posture.

Working Hours

40 hours/week

Company Size

1,001-5,000 employees

Language

English

Visa Sponsorship

About The Company

Power your finance, grow your business. Razorpay is India’s first full-stack financial solutions company. We are on a mission to enhance the payment experience of over 300 million end consumers. And in doing so, we aim to enable Indian businesses - big and small - accept payments digitally with minimal effort and maximum ease. Razorpay has grown from being a payment gateway provider to a solutions-driven organization boasting of an extensive products suite to accept and disburse payments as well as raise capital and park money. In a nutshell, we fit into every nook and corner where your business touches money. #OutgrowOrdinary We identify ourselves as disruptors in the digital payments space and our vision is to power the financial ecosystem for other disruptors. Like attracts like and Razorpay actively looks to partner with established companies and startups that have either broken the glass ceiling in their industry or are set to. The Razorpay Product Suite today comprises verticals, along with Payment Gateway, like Payment Links, Payment Pages, Subscriptions, Smart Collect, Route, Razorpay Capital, RazorpayX, Payroll and Thirdwatch. Razorpay was started in 2014 by two IIT Roorkee alumni, Harshil Mathur and Shashank Kumar. Just a short few years later, Razorpay has evolved into a 800-odd strong organization with some of the best talents in the country helping some of the best companies manage their money movement seamlessly. Certified cool We are a bunch of spirited, ambitious and fun folks. And no, we’re not saying this ourselves--leading institutions have recognized Razorpay for the high trust and high-performance culture that we maintain. Our strength lies in the people we are and we go to great lengths to nurture a family of coders, designers, sellers, marketers, analysts, writers, runners, photographers, gamers, tinkerers, and above all, people who are dreamers and doers at the same time. Be a part of our exciting journey.

About the Role

<div class="content-intro">Razorpay is one of India’s leading full-stack financial technology companies, powering the way businesses move, manage, and grow money. Founded in 2014 by Harshil Mathur and Shashank Kumar with a simple vision — to simplify payments for Indian businesses — we’ve since grown into a fintech powerhouse driving India’s digital payment revolution. Razorpay powers millions of businesses with a smarter, scalable stack that goes beyond transactions to help them truly build and grow. From seamless checkouts to payroll automation, across India, Singapore, and Malaysia, we’ve been engineering a fintech ecosystem that’s redefining how money moves across Asia — and we’re just getting started. Today, that ecosystem supports everyone from early-stage startups to some of India’s largest enterprises, enabling them to accept, process, and disburse payments at scale while expanding into new ways of managing money more efficiently. Our scale speaks volumes: Razorpay processes $180+ billion in annualized transactions, powering leading businesses like Airbnb, Facebook, WhatsApp, Airtel, CRED, BookmyShow, Zomato, Swiggy, Lenskart, Mirae Asset Capital markets, Indian Oil, National Pension Scheme — and over 100 of India’s unicorns. With strong roots in India and growing operations in Southeast Asia, we are shaping the next chapter of financial technology across the region. We are backed by global investors including GIC, Peak XV Partners (formerly Sequoia Capital India & SEA), Tiger Global, Ribbit Capital, Matrix Partners, MasterCard, and Salesforce Ventures, having raised over $740 million to date. Strategic acquisitions — including Ezetap (POS and offline payments), Curlec (Malaysia expansion), BillMe (digital invoicing), and POP (rewards-first UPI) — along with earlier moves in fraud prevention, payroll, and lending, have further strengthened our platform and widened our footprint across Asia. But what truly sets Razorpay apart is our culture. At Razorpay, ownership is our oxygen — you own what you build, with no micromanagement or red tape, just the runway to make your ideas fly. Learning is a lifestyle — if you’re curious, you’ll feel at home here. People > Pedigree — we hire for attitude, hustle, and hunger more than degrees. Transparency thrives over titles — this is where interns question CXOs and CXOs say “thank you.” Guided by our values of Customer First, Autonomy & Ownership, Agility with Integrity, Transparency, Challenging the status quo and a strong belief that Razorpay grows with Razors,  you’ll be part of a 3000+ strong team building not just products, but the financial infrastructure of the future.</div>Title: Senior Product Security Engineer The Role: Razorpay is looking for a Senior Application Security Engineer with solid experience in AppSec fundamentals—secure code review, vulnerability discovery, API security, and practical pentesting skills. The ideal candidate should also be able to perform basic threat modeling for new features and understand the emerging risks from AI-driven attack patterns. Roles/Responsibilities: <ul> <li>Perform application-level pentests across web, mobile, and backend services.</li> <li>Identify, validate, and help remediate vulnerabilities including OWASP Top 10, API Top 10, and logic flaws.</li> <li>Conduct security assessments for identity flows, API endpoints, micro-services, and internal tools.</li> <li>Review code (manual + assisted) to detect common AppSec issues. Application Security &amp; Pentesting</li> <li>Perform application-level pentests across web, mobile, and backend services.</li> <li>Identify, validate, and help remediate vulnerabilities including OWASP Top 10, API Top 10, and logic flaws.</li> <li>Conduct security assessments for identity flows, API endpoints, micro-services, and internal tools.</li> <li>Review code (manual + assisted) to detect common AppSec issues.</li> </ul> Threat Modeling (Basic) <ul> <li>Perform threat modeling for new features:</li> <li>Identify data-flow risks</li> <li>Spot common misconfigurations</li> <li>Highlight authentication/authorization concerns</li> <li>Document potential abuse cases and propose simple, actionable mitigations.</li> </ul> AI / LLM Security (Introductory) <ul> <li>Understand the basics of AI-driven attack vectors: prompt manipulation, data leakage, misuse of LLM-based features.</li> <li>Flag potential AppSec risks in AI-assisted workflows or model integrations.</li> <li>Support teams in implementing simple guardrails around AI/LLM usage.</li> </ul> Secure SDLC &amp; Developer Productivity <ul> <li>Integrate AppSec checks into CI/CD pipelines—SAST, SCA, secrets scanning, basic DAST.</li> <li>Support engineering teams with secure coding guidance and easy-to-consume AppSec patterns.</li> <li>Help create developer-friendly standards, checklists, and best practices.</li> </ul> Tooling &amp; Automation <ul> <li>Write small scripts or utilities (Python/JS/Go) for repetitive security checks.</li> <li>Contribute to improving internal AppSec automation and dashboards.</li> </ul> Requirements: <ul> <li>A Bachelor&#39;s degree in Computer Science, Cybersecurity, or a related field.</li> <li> A minimum of 5-8 years of experience in application security.</li> <li>Hands-on experience with offensive security practices and product security vulnerability management.</li> <li>Practical pentesting experience with tools like Burp Suite, ZAP, Postman, and custom scripts.</li> <li>Basic working knowledge of threat modeling techniques (STRIDE-lite, DFD- based reasoning, or simple checklist-based models).</li> <li>Familiarity with AI/LLM security basics (prompt injection, data leakage paths, output validation).</li> <li>Programming/scripting experience (Python/JS/Go preferred).</li> <li>Experience with AppSec tools in CI/CD.</li> </ul> Location: Bangalore<div class="content-conclusion"><div class="gmail_default">Razorpay believes in and follows an equal employment opportunity policy that doesn't discriminate on gender, religion, sexual orientation, colour, nationality, age, etc. We welcome interests and applications from all groups and communities across the globe. </div> <div class="gmail_default"> </div> <div class="gmail_default">Follow us on <a href="https://www.linkedin.com/company/razorpay/mycompany/" target="_blank" data-saferedirecturl="https://www.google.com/url?q=https://www.linkedin.com/company/razorpay/mycompany/&source=gmail&ust=1660290870959000&usg=AOvVaw0f6sCrv8Ce3IHBvN2Sev8Z">LinkedIn</a> & <a href="https://twitter.com/Razorpay" target="_blank" data-saferedirecturl="https://www.google.com/url?q=https://twitter.com/Razorpay&source=gmail&ust=1660290870959000&usg=AOvVaw0ViuP9uutFg1qFCm2nHeh1">Twitter</a></div></div>

Key Skills

Cloud SecurityCybersecurityKubernetesAWSIAMVulnerability ManagementScriptingPythonBashOffensive SecurityInfrastructure as CodeTerraformCloudFormationSecurity AwarenessProblem SolvingCommunication