Associate Information Security Engineer
Company: Reward360 Global Services Private Limited
Location: Bengaluru, Karnataka, India
Experience: 1–2 years
Department: Information Security / Engineering
Job Overview
As an Associate Information Security Engineer at Reward360, you will be a vital part of our offensive and defensive security operations. You will focus on simulating real-world cyberattacks, identifying vulnerabilities within our core loyalty platforms, and collaborating directly with development teams to ensure a resilient infrastructure. This is an ideal role for an ambitious professional looking to bridge the gap between application security, cloud penetration testing, and secure code review.
Key Responsibilities:
- Offensive Security & Pentesting: Conduct White-Box and Grey-Box penetration testing across internally developed web applications, microservices, APIs, and cloud infrastructure with AI approach.
- Vulnerability Assessment: Utilize manual exploitation techniques alongside automated tooling to detect flaws, API security gaps, and misconfigurations before they reach production.
- Secure Code Review: Analyze source code manually and leverage
- SAST/DAST utilities to identify logical, cryptographic, and injection vulnerabilities.
- Remediation & Mitigation: Collaborate with product managers and product development software engineers to provide actionable triage, remediation guidance, and verification re-testing.
- CI/CD Integration: Assist in scaling security controls and guardrails by promoting automated security checks within the active DevOps pipelines.
- Threat Modeling: Assist with early-lifecycle threat modeling to architect secure and low-risk software deployments.Followed by STRIDE,PASTA,and MAESTRO,
Required Skills & Experience:
- Technical Capabilities & Frameworks
- Comprehensive understanding of web and API security standards, specifically the OWASP Top 10 and OWASP API Security methodologies.
- Practical familiarity with foundational penetration testing frameworks such as PTES, OSSTMM, or NIST.
- Exposure to cloud computing security fundamentals, with a strong emphasis on Amazon Web Services (AWS) environments.
- Hands-on knowledge in EKS and ECS Security
- Security Infrastructure & Tooling
- Hands-on familiarity with penetration testing operating systems like Kali Linux or Parrot OS.
- Everyday capability with interception proxies and security scanners, including Burp Suite, Caido, Nessus
- Ability to script basic automation utilities using programming languages like Python or JavaScript.
- Education & Certifications (Preferred)
- Education: B.E. / B.Tech / BCA / M.Tech in Computer Science, Information Security, or a related field.
- Certifications (Good to have): CEH (Certified Ethical Hacker)/CRTP/CPTS