Senior Security Engineer

Senior Security Engineer, XFlow

XFlow is building cross-border payments infrastructure that provides businesses access to global markets, starting with those in India and subsequently other parts of South & South East Asia. We are enabling users to accept and payout money globally in a simple, reliable, compliant, transparent and financially compelling manner.

Building payments infrastructure is hard, and elegantly solving for cross-border payments infrastructure for businesses even more so. The complexity stems from the different changing regulatory requirements of the many countries that we will operate in, building payment guarantees in existing rails (or for that matter, creating a new payment rail altogether) and capturing value in a way where we are net additive to our users. This complexity excites and motivates us because we know that when we get it right, businesses around the world and their customers will be better off for it.

Finally, and we cannot stress this enough, culture eats everything else for breakfast. We aim to be an engineering driven company that believes finance problems are rooted in code and strongly prefer individuals who share a similar belief.

You will:

• Engineer, implement and monitor security measures for the protection of computer systems, networks and information

• Perform vulnerability testing, risk analysis and security assessments for every software and system change

• Continuously monitoring for changing cyber threats, Identify and communicate current and emerging cyber security threats to relevant stakeholders.

• Perform assurance services to assess IT security controls across various platforms (Linux, Unix, Mac, Windows), compliance needs (example ISO-27001, SOC2, GDPR) and regulations (example SOX, PCI DSS).

• Secure endpoints or entry points of end-user devices such as desktops, laptops, and mobile devices from being exploited by malicious actors and campaigns.

• Develop, test and modify custom security testing scripts for vulnerability testing.

• Identify and define system security requirements

• Research, recommend and document security architecture, prepare and document standard operating procedures and protocols

• Develop technical solutions and adopt security tools to help mitigate security vulnerabilities and automate repeatable tasks

• Ensure that the company knows as much as possible, as quickly as possible about security incidents

• Write comprehensive reports including assessment-based findings, outcomes and propositions for further system security enhancement

• Analyze security incident reports and implement mitigation plan

• Guide product development with security first mindset practices and meet security assurance and compliance needs.

• Own and adopt robust security tools and techniques, understand security trade-offs in the face of threats, attacks or vulnerabilities.

• Work with stakeholders and other business units to ensure the appropriate security assurance requirements are established in our security policies, enforced, and communicated.

You have:

• 6-8 years proven work experience as a Security Engineer

• Hands-on experience of AWS (or GCP or equivalent) cloud operating model and relevant security practices.

• Deep understanding of networks, database and operating system security

• Proficient with Windows, Unix, and Linux Operating Systems environment.

• Hands-on experience in security systems, including firewalls, intrusion detection systems, anti-virus software, authentication and authorization systems, log management, content filtering, etc.

• Deep understanding of network elements such as switches, routers, firewalls, IPS/IDS and the related rulesets, ACLs. Additional knowledge on configurations specific to AWS Network ACLs, Security Groups etc and their equivalent in GCP etc.

• Automation & Scripting in Bash & Python

• Thorough understanding of the latest security principles, techniques, and protocols

• Strong problem solving skills

• BE/BS or MS or MTech degree in Computer Science or related security field

• Security Certifications would be treated as a plus. Examples include: CISSP, CISA, CRISC, OSCP.

Contact:

If you think you’re the person we’re looking for, please write to [email protected]