Job Description

Cybersecurity Engineer – Engineering

Experience: 6+ Years

Location: Kolkata, India / Gurgaon, India (On-site)

Reports to: Head of Engineering / Security Lead

Employment Type: Full-time

About Practice by Numbers

Practice by Numbers (PbN) is a fast-growing SaaS platform helping healthcare organizations leverage data, automation, patient engagement, and operational intelligence to improve business performance and patient outcomes. We build highly scalable cloud-native products serving thousands of customers across North America.

We handle protected health information at scale. Security is not a compliance checkbox for us — it is a product requirement. We are looking for a Cybersecurity Engineer who can secure a live, fast-moving cloud platform hands-on.

Role Overview

As a Cybersecurity Engineer, you will own the security posture of our AWS cloud infrastructure and our Python/Django, FastAPI, Node.js, and React applications. You will find real vulnerabilities, fix them or drive them to closure, and build the controls and automation that stop the same class of issue from recurring.

This is a hands-on, technical role. You will read code, review architecture, run tests against our own systems, tune detections, respond to incidents, and carry the technical side of our HIPAA and SOC 2 obligations. You will work directly with engineering rather than filing findings over a wall.

The ideal candidate has genuine application and cloud security depth, understands how software is actually built and deployed, and can tell a real risk from a scanner artifact.

Key Responsibilities

Application Security

• Perform secure code reviews across Python/Django/FastAPI, Node.js, and React/TypeScript codebases.
• Threat model new features and services; identify design-level risks before they ship. Own SAST, DAST, dependency, secret, and container scanning — including triage, false-positive reduction, and driving fixes to closure.
• Run white-box (source-assisted), grey-box (authenticated, partial-knowledge), and black-box (external, zero-knowledge) security testing against our own applications and APIs.
• Test authentication, authorization, multi-tenant isolation, and session handling; hunt for IDOR, privilege escalation, and tenant data leakage.
• Review API security: input validation, rate limiting, authorization enforcement, and data exposure. Define and maintain secure coding standards; coach engineers through review rather than mandate.

Cloud & Infrastructure Security

• Harden AWS infrastructure — IAM least privilege, VPC and network segmentation, security groups, encryption at rest and in transit, S3 and RDS controls.
• Review Terraform and infrastructure-as-code for security defects; add policy-as-code guardrails. Secure containerized workloads (Docker, ECS/Fargate or EKS) — image hygiene, runtime configuration, secrets handling.
• Own secrets management practices (AWS Secrets Manager, SOPS, Vault) and key rotation. Continuously audit cloud configuration drift and remediate exposure.

Security Operations & Incident Response

• Build and tune detection and alerting across cloud, application, and access logs. Investigate security alerts; separate real signal from noise.
• Lead incident response — containment, forensics, root cause, and blameless post-incident review. Maintain and exercise the incident response plan, including breach-notification readiness. Run vulnerability management end to end: discovery, risk-based prioritization, SLA tracking, verification.

Compliance & Governance (Technical Ownership)

• Own the engineering side of HIPAA and SOC 2 — implement controls, produce evidence, and support audits.
• Maintain audit logging, access review, data retention, and encryption controls. Support security questionnaires, customer security reviews, and third-party/vendor assessments. Coordinate external penetration tests and drive remediation of findings.
• Keep security policies and technical documentation accurate as systems change.

Security Engineering & Automation

• Embed security checks into CI/CD (GitHub Actions) so issues surface at pull-request time. Write Python and shell automation for evidence collection, configuration auditing, and remediation.
• Build tooling and guardrails that make the secure path the easy path for engineers. Improve identity and access management across cloud, SaaS, and internal tooling.

Collaboration & Enablement

• Partner with engineering, DevOps, and product teams as an embedded security reviewer. Run practical security training and awareness for engineering.
• Communicate risk clearly to both technical and non-technical audiences, with a recommendation attached.

AI-Enabled Engineering

• Use modern AI tools to accelerate code review, detection engineering, and analysis.
• Apply AI-assisted practices while maintaining rigorous verification, data-handling, and review standards.
• Assess and secure the organization’s own use of AI services, including data-exposure risk.

Required Qualifications

• Bachelor’s or Master’s degree in Computer Science, Information Security, or a related discipline. 6+ years in cybersecurity, with substantial application security or cloud security ownership. Strong AWS security experience — IAM, VPC networking, encryption, logging, and common misconfiguration patterns.
• Ability to read and reason about production code; Python strongly preferred, plus JavaScript/TypeScript.
• Hands-on web application and API security testing (OWASP Top 10, OWASP API Security Top 10) using black-box, grey-box, and white-box approaches.
• Ability to write up findings with reproducible steps, impact, severity rationale, and a concrete remediation path.
• Practical experience with SAST/DAST/SCA and container scanning tooling, including triage and remediation.
• Working knowledge of Docker and container orchestration (ECS/Fargate or EKS). Experience with vulnerability management and incident response in production environments. Familiarity with HIPAA, SOC 2, or equivalent compliance frameworks.
• Solid Linux fundamentals, networking, and cryptography basics.
• Clear written and verbal English; ability to document findings and risk decisions precisely.

Technical Expertise

Application Security

• Secure Code Review (Python / Django / FastAPI, Node.js, React / TypeScript) Threat Modeling (STRIDE or equivalent)
• OWASP Top 10 / OWASP API Security Top 10
• Authentication, Authorization, Multi-Tenant Isolation
• Black-Box / Grey-Box / White-Box Penetration Testing
• Manual Exploitation and Proof-of-Concept Development
• SAST / DAST / SCA, Secret and Dependency Scanning
• Burp Suite, OWASP ZAP, Semgrep, Trivy, and similar tooling

Cloud & Infrastructure Security

• AWS IAM, VPC, Security Groups, KMS, GuardDuty, Security Hub, CloudTrail, Config ECS / Fargate / EKS Workload Security
• Terraform Security Review, Policy as Code (OPA, Checkov, tfsec)
• Secrets Management (AWS Secrets Manager, SOPS, Vault)
• Network Segmentation and Perimeter Controls

Security Operations

• SIEM / Log Analytics and Detection Engineering
• Incident Response and Digital Forensics
• Vulnerability Management and Risk-Based Prioritization
• Audit Logging, Access Review, Monitoring and Alerting

Data Protection & Compliance

• Encryption at Rest and in Transit, Key Management
• PHI / PII Handling, Data Classification, Retention
• HIPAA, SOC 2, HITRUST, NIST CSF, ISO 27001
• Vendor and Third-Party Risk Assessment

Platform Context

• PostgreSQL Security and Access Control
• Kafka / Redpanda / Amazon MSK, Redis
• GitHub Actions and CI/CD Security
• Python and Shell Automation

Preferred Qualifications

• Security certifications — OSCP, CISSP, AWS Security Specialty, GIAC (GWAPT, GCIH, GCSA), or CEH.
• Experience securing multi-tenant SaaS platforms and tenant-isolation models. Prior experience carrying a SOC 2 Type II audit or HIPAA program through to completion. Offensive security background — black-box penetration testing, red teaming, or bug bounty experience.
• Experience scoping and managing third-party black-box or grey-box penetration tests. Kubernetes security.
• Experience with event-driven architectures and message-broker security.
• Detection-as-code and security automation at scale.
• Exposure to healthcare technology or other regulated domains.
• Experience securing AI/LLM-integrated applications.

What We Look For

• Genuine hands-on depth — you find real issues, not just scanner output.
• Engineering mindset: you fix and automate rather than only report.
• Sound risk judgment and the ability to prioritize what actually matters.
• Strong collaboration; engineers should want your review, not dread it.
• Precise written communication and clean documentation.
• Integrity, discretion, and ownership when handling sensitive data.
• Continuous learning as the threat landscape moves.

Why This Role

• Security ownership of a healthcare platform where the stakes are real.
• Breadth across application, cloud, and operational security in one role.
• Modern stack: AWS, Terraform, GitHub Actions, Docker, Python, React, PostgreSQL, Kafka compatible messaging.
• Direct influence on architecture and engineering practice, not a downstream audit function.