Zeta

Cloud-native payment card issuer platform

Product Security Engineer 2

Security Engineering & ArchitectureConfirmed live in the last 24 hours

Full-timeHyderabad, Telangana, IndiaNo salary listedIn-person

About the Job

Requirements

Hands-on vulnerability assessment and penetration testing experience in web, mobile, software development kits, application programming interfaces, and networks.
Thorough understanding of the OWASP Top 10 and its attack and defense mechanisms.
Exposure to Secure Software Development Lifecycle activities, threat modeling, and secure coding.
Experience with commercial and open-source security tools including Burp Suite, AppScan, OWASP ZAP, BeEF, Metasploit, Qualys, Nessus, and Snyk.
Ability to identify and exploit business logic-related vulnerabilities.
Solid understanding of cryptography and knowledge of public key infrastructure-based systems and Transport Layer Security.
Understanding of authentication and authorization frameworks including OpenID Connect, OAuth, and SAML, and ability to read, write, and understand Java code.
Experience performing static analysis and code reviews using tools including Snyk, Veracode, Checkmarx, and SonarQube.
Hands-on experience reversing mobile applications and working with class or small files, data obfuscators, or ciphers using tools such as Dex2jar, adb, Drozer, Clang, and iMAS, and with dynamic instrumentation tools such as Frida and Objection.
Ability to execute penetration tests and security assessments on internal and external networks, Windows and Linux environments, and AWS cloud infrastructure.
Ability to identify and exploit incorrect configurations and security vulnerabilities on Windows and Linux servers, and safely use penetration-testing tools, tactics, and procedures.
Shell scripting or automation of simple tasks using Python or Ruby.
Knowledge of PCI DSS and PCI SSF, including S3 and SSLC.
Knowledge of security standards such as PCI DSS, UIDAI, GDPR, and NIST.
Understanding of Java frameworks such as Spring Boot, CI/CD, and Jenkins.
In-depth understanding of production operations on public cloud infrastructure.
Must have participated in bug bounty programs such as HackerOne and Bugcrowd.
Experience conducting hackathons and capture-the-flag events.
Knowledge of AWS or Azure services and infrastructure, including VPC/VNet, S3 buckets, blob stores, and load balancers, as well as Docker, containers, and Kubernetes.
Good understanding of agile development practices.
Knowledge of databases including PostgreSQL, Redshift, and MySQL, and other data stores such as Elasticsearch and S3 buckets.
Four or more years of experience developing large-scale internet or SaaS applications.
Two to three years of overall experience as a web or mobile application security engineer or developer in a medium- to large-sized product company.
Bachelor of Technology (BE/B.Tech), M.Tech, or ME in Computer Science or equivalent from a Tier-1 engineering college or university.

Responsibilities

Perform regular vulnerability assessments and penetration tests for web and mobile applications, APIs, and infrastructure.
Guide developers in fixing security issues.
Conduct regular code reviews.
Participate in application design discussions.
Perform threat modeling of web and mobile applications.
Develop secure coding practices and educate development and QA engineers by building security standards and policies for secure coding, secure data handling, secure networking, and secure cryptographic implementation.
Evaluate and integrate security testing tools, including SAST, DAST, and SCA, into CI/CD pipelines.
Guide the technology organization’s security and privacy initiatives by participating in design reviews and threat modeling.
Ensure applications developed by developers and product managers are secured and hardened.
Define project scope and ensure continuous adherence to it through each phase, from initiation to sustenance and maintenance.
Create visibility and adoption of projects intended for internal customers.
Act as a security engineering expert and technical champion within the organization.
Assess gaps and tools to improve application security.
Liaise with internal and external stakeholders for the team.
Mentor developers and QA engineers.
Evaluate bugs reported through the Bug Bounty program.
Run security posture reviews of applications across business units.
Continuously improve web and mobile application security.
Conduct quarterly internal and external, authenticated and unauthenticated vulnerability assessments and penetration tests for mobile and web applications.
Securely configure web and mobile applications, databases, and data.

Desired Qualifications

Certifications such as OSCP, GWAPT, Advanced Web Attacks and Exploitation (AWAE), and CompTIA Security+.
FinTech domain experience is highly desirable.
Knowledge of payment key management, cryptographic key handling, and HSM operations.
Experience with Cloudflare WAF rule review, configuration, and tuning; Cloudflare traffic and event monitoring; bot traffic analysis; and detecting and handling anonymous or unauthenticated API calls.

About us:
Build the future of banking.

Zeta is a next-generation banking technology company providing cloud-native, fully stackable processing and core banking platforms for issuers. With a focus on scalability, compliance, and innovation, Zeta empowers financial institutions to modernize their technology infrastructure and deliver secure, seamless digital banking experiences.

Our impact runs at real-world scale. Today, over 25 million cards are live on Zeta-powered platforms across 7 countries, supported by a passionate team of 1,700+ Zetanauts across India, the US, EMEA, and Asia. Backed by SoftBank Vision Fund, Mastercard, and other reputed strategic investors, we reached a valuation of $2 billion in 2025.

Our focus is on establishing product lines that focus on key outcomes by addressing real customer pain points, modernizing legacy systems, and strengthening core fundamentals. As a result, our systems and platforms support a wide range of banking and payments capabilities, including:

1. Tachyon, our cloud-native banking stack built for population-scale systems

2. Cipher, our unified authentication platform for secure, high-volume banking environments

3. Digital Credit as a Service, enabling banks to launch credit lines on UPI

4. Elena, our intelligent and conversational AI platform for banking

5. Pixel, India’s first digital-native credit card, launched in partnership with HDFC Bank, for whom we also revamped their PayZapp mobile app: Winner of the Celent Model Bank Award for Payments Innovation 2024

6. Sparrow, the leading card experience for non-prime cardholders in the US

…and more across cards, payments, lending, and core banking.

We are an engineering-first organization that values ownership, bias for action, and long-term thinking. Together, we solve some of the hardest problems in banking tech. Our culture is built around trust, collaboration, and creating the conditions for you to drive impact proportionate to your potential. Reinforcing our commitment to creating an inclusive and supportive workplace, we have been consistently recognized as a Great Place to Work.

If you want to build cutting-edge banking tech that enables banks to serve millions reliably, securely, and at a population scale, Zeta is your playground.

If you would like to learn more about how we have grown and evolved over the years, watch our journey here. You can also explore our website and follow us on LinkedIn, Instagram, YouTube, and X.

About the Role:

This role is part of the Risk & Compliance Team, Engineering division of Zeta. The Product Security Engineer is responsible to secure all mobile & web applications along with API’s by breaking and hacking them and educating Developers as well as DevOps teams on how to fix them. The objective is to make zeta applications and platforms secure. As Application Security Engineer of the Product Security sub-division, you will be responsible for securing all the Zeta’s Products. You will be working as an individual contributor reporting to a manager.

Perform regular VA/PT for Web & Mobile applications, API & Infrastructure

Guide developers in fixing security issues.

Regular code reviews

Involve in application design discussions.

Perform Threat Modelling of Web/Mobile applications.

Develop secure code practices and educate dev and QA engineers by building security standards, policies for secure coding, secure data handling, secure networking, secure crypto implementation, etc.

Evaluate & Integrate security testing tools (SAST, DAST,SCA) in to CI/CD pipelines.

Responsibilities:

Guide the technology organization's security and privacy initiatives by participating in design reviews and threat modelling.

The applications are developed by the developers and product managers, and you will make sure the applications are secured and hardened.

You will define the scope and ensure continuous adherence to the scope of projects at each phase (initiation to sustenance/maintenance phase).

You will be responsible for creating visibility, and adoption of the projects meant for internal customers.

Act as a security engineering expert and technical champion within Zeta.

Assess gaps, and tools to improve application security

Liasoning with all external and internal stakeholders for the team.

Mentoring developers and QA.

Evaluate bugs reported through the Bug Bounty program.

Run security posture of various applications across BU’s.

Continuous improvement of web/mobile application security

Quarterly VA/PT (internal/external, authenticate/non-authenticated) for mobile/web.

Secure configuration of Web/Mobile application, DB, Data etc.

Skills:

Hands on VA/PT experience in Web, Mobile, SDK, API & Network

Thorough understanding of OWASP Top 10, their attack & defense mechanisms

Exposure to Secure SDLC Activities, Threat Modelling & Secure Coding

Experience with both commercial and open-source tools like Burp suite, AppScan, OWASP ZAP, BEEF, Metasploit, Qualys, Nessus, Synk etc.

Identifying and exploiting business logic-related vulnerabilities.

Solid understanding of Cryptography, knowledge of PKI-based systems, TLS

Understanding of different AuthN/AuthZ frameworks (OIDC, oAuth, SAML) able to read/write/understand java code

Performed Static Analysis, Code reviews using tools like Snyk, Veracode, Checkmarx, Sonarqube etc.

Hands on Reversing mobile applications, class/small files, data obfuscators, or ciphers (Dex2jar, adb, Drozer, Clang, iMAS) and Dynamic Instrumentation tools like Frida/Objection

Execute penetration tests and security assessments on internal and external networks, Windows and Linux environments, cloud (AWS) Infrastructure.

Identify and exploit incorrect configurations and security vulnerabilities on Windows and Linux servers. Safely utilize tools, tactics, and procedures used in penetration testing engagements.

Shell scripting or automation of simple tasks using Python, or Ruby

Knowledge of PCI DSS, PCI SSF (S3, SSLC) etc.

Knowledge of security standards like PCI DSS, UIDAI, GDPR, NIST, etc.

Understanding Java Frameworks like Springboot, CI/CD, Jenkins.

In-depth understanding of production operations on public cloud infrastructure.

Excellent written and oral communication and a penchant for technical documentation.

Must have participated in various bug bounty programs (HackerOne, Bug Crowd, Private etc)

Experience in conducting hackathons and CTF’s

Knowledge of AWS/Azure (VPC/Vnet, S3 buckets, blob stores, LoadBalancers etc.), Dockers & Containers, Kubernetes

Good understanding of agile development practices.

Certifications like OSCP(Preferred), GWAPT, Advanced Web Attacks and Exploitation (AWAE), Comptia Security+

Knowledge of Databases - Postgresql, Redshift, My SQL etc. and other data stores like Elasticsearch and S3 buckets.

Experience in the FinTech domain is highly desirable.

Knowledge of payment key management, cryptographic key handling, and HSM operations will be an added advantage.

Cloudflare WAF experience or knowledge in the areas:

Cloudflare WAF Rules Review and Configuration

Cloudflare WAF Rules Tuning

Cloudflare Traffic and Event Monitoring

Bot Traffic Analysis

Detecting and handling anonymous or un-authenticated API Calls.

Experience and Qualifications:

4+ years of experience in developing large scale internet or SaaS applications.

2 to 3 years of overall experience as Web/Mobile Application Security engineer or Developer in medium to large-sized product companies.

Bachelor of Technology (BE/B.Tech), M.Tech or ME in Computer Science or equivalent from a Tier-1 engineering college/university.

Zeta is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. We encourage applicants from all backgrounds, cultures, and communities to apply and believe that a diverse workforce is key to our success.

About the Company

Zeta

Cloud-native payment card issuer platform

Zeta provides cloud-native, API-connected payment card issuer processing platforms for banks, financial institutions, and fintechs. Its core product, Omni Stack, lets clients launch and manage digital credit, debit, and prepaid card programs through integrated APIs and cloud services. Transactions and card program management are handled via the platform, often with managed services and partner integrations (e.g., Sparrow) to offer comprehensive payment solutions. The company differentiates itself with a fully cloud-native, API-first approach combined with strong regulatory compliance (ISO IEC 27001, PCI DSS 4.0, SOC 2 Type 2), enabling rapid deployment and secure operation of embedded banking and payments. Zeta’s goal is to accelerate the world toward invisible payments by rethinking payment systems from core to edge.

Company size: 1,001-5,000
Company stage: Late Stage VC
Total funding: $430M
Headquarters: San Ramon, CA
Founded: 2015

Recently Posted Jobs

Explore more opportunities at Zeta

See more jobs