Senior Security Engineer – Vulnerability Management & Penetration Testing

About the role

Truveta is seeking a Senior Security Engineer to lead vulnerability management and penetration testing across its applications and infrastructure. The role is hands‑on, focusing on identifying, validating, and remediating security issues while building scalable processes to improve the overall security posture.

Key responsibilities

• Own the full vulnerability management lifecycle: continuous scanning of applications, infrastructure, and dependencies, risk‑based prioritization, tracking, and remediation.
• Perform penetration testing on web applications, APIs, and cloud environments, validating findings and eliminating false positives.
• Partner with engineering teams to fix vulnerabilities and prevent recurrence.
• Implement and manage security tools for SAST, DAST, dependency, infrastructure, and container scanning.
• Develop repeatable testing methodologies, automation, and adversarial testing to simulate real‑world attacks.
• Track metrics, report on risk posture, and contribute to secure development practices.

Required profile

• 5–9+ years of experience in security engineering, vulnerability management, or penetration testing.
• Hands‑on experience with web and API security testing and common vulnerabilities (OWASP Top 10, misconfigurations, authentication flaws).
• Strong understanding of attack techniques, exploitation methods, and cloud environments (Azure preferred).
• Relevant certifications such as OSCP, CEH, or GWAPT are a plus.

Required skills

• Web application security testing
• API security testing
• OWASP Top 10 knowledge
• SAST and DAST tools
• Dependency, infrastructure, and container scanning
• Azure cloud environment
• CI/CD pipeline automation for security testing
• Kubernetes and container security
• Bug bounty or red‑team experience
• OSCP, CEH, GWAPT certifications