Job description

Job Description

Senior Security Engineer

Department: Engineering

Reporting To: CTO

Experience: 7–10 Years

Location: Ahmedabad (Preferred)

Role Summary

Artem HealthTech is seeking an experienced Senior Security Engineer to design, implement, and continuously improve cybersecurity controls across our Healthcare Information Management System (HIMS), cloud infrastructure, applications, and DevSecOps ecosystem.

The role is responsible for embedding security throughout the Software Development Life Cycle (SSDLC), protecting healthcare data, strengthening cloud and infrastructure security, leading vulnerability management, and supporting enterprise security initiatives aligned with ISO/IEC 27001, ISO/IEC 27034, DPDP, HIPAA, GDPR, CERT-In, NABH, and ABDM.

The ideal candidate will possess strong technical expertise in Application Security, Cloud Security, Infrastructure Security, DevSecOps, Incident Response, Vulnerability Management, Identity & Access Management, and Security Automation, while collaborating closely with Product Engineering, QA, DevOps, SRE, and Compliance teams.

Key Responsibilities

Product & Application Security

Expectation: Build secure-by-design healthcare applications throughout the development lifecycle.

Implement Secure Software Development Life Cycle (SSDLC)
Conduct Threat Modeling and Secure Architecture Reviews
Establish Secure Coding Standards (OWASP ASVS, OWASP Top 10, CWE)
Integrate SAST, DAST, SCA, Secret Scanning, IaC Security, Container Security, API Security and SBOM generation into CI/CD pipelines
Coordinate internal and external Penetration Testing (VAPT)
Validate security before every production release
Drive remediation of application vulnerabilities
Secure REST APIs, Mobile Applications, Microservices and Kubernetes workloads

ISO/IEC 27034 – Application Security

Expectation: Lead implementation of ISO/IEC 27034 Application Security Framework.

Implement Application Security Management Process (ASMP)
Develop Organization Normative Framework (ONF)
Define Application Security Controls (ASC)
Establish security gates throughout SDLC
Maintain Application Security documentation and evidence
Support ISO/IEC 27034 certification readiness and external audits
Measure and improve Application Security Maturity

Cloud & Infrastructure Security

Expectation: Protect cloud and enterprise infrastructure using Zero Trust principles.

Secure Google Cloud Platform (preferred), AWS or Azure environments
Implement IAM, RBAC, MFA and PAM controls
Harden Linux, Windows, Containers and Kubernetes clusters
Perform Infrastructure Security Assessments
Secure cloud networking, storage, encryption and endpoint security
Implement CSPM and cloud security best practices
Support Zero Trust Network Architecture

Security Operations & Incident Response

Expectation: Improve cyber resilience through proactive monitoring and response.

Support SIEM/SOAR implementation and use cases
Investigate security incidents and coordinate response
Perform Threat Hunting and Threat Intelligence analysis
Develop ransomware recovery and cyber incident playbooks
Support SOC monitoring and continuous security improvements

Vulnerability & Patch Management

Expectation: Continuously identify and remediate security risks.

Conduct Infrastructure, Cloud and Application Vulnerability Assessments
Coordinate External Security Audits and Penetration Testing
Manage enterprise vulnerability lifecycle
Validate remediation within defined SLAs
Produce executive vulnerability dashboards and reports

Governance, Compliance & Risk Management

Support implementation of ISO/IEC 27001 ISMS
Support ISO/IEC 27034 Application Security Certification
Ensure compliance with DPDP, HIPAA, GDPR, CERT-In, NABH and ABDM
Participate in security risk assessments and internal audits
Assist customer security assessments and regulatory audits
Maintain security policies, procedures and technical standards

Data Protection & Identity Security

Implement Data Classification and Encryption standards
Support DLP initiatives
Secure databases and sensitive healthcare information
Implement Identity & Access Management (IAM), RBAC, MFA and PAM
Conduct periodic access reviews and privilege assessments

AI & Emerging Technology Security

Assess AI/LLM security risks
Secure AI APIs, Prompt Engineering and RAG implementations
Support AI Governance initiatives aligned with ISO/IEC 42001, NIST AI RMF and Google SAIF
Implement secure AI development practices

Security Awareness & Collaboration

Conduct secure coding and cybersecurity awareness sessions
Mentor development teams on secure engineering practices
Collaborate with Product Management, Engineering, QA, DevOps and SRE teams to establish Security-by-Design culture
Support third-party security assessments and vendor risk reviews

Required Skills & Qualifications

Education

Bachelor's Degree in Computer Science, Information Technology, Cyber Security or equivalent

Experience

7–10 years of hands-on Information Security experience
Experience securing SaaS or Healthcare applications preferred
Experience implementing DevSecOps and Secure SDLC
Experience with cloud security and enterprise infrastructure
Strong understanding of healthcare regulatory requirements is desirable

Technical Skills

Security

Secure SDLC (SSDLC)
Application Security
DevSecOps
Threat Modeling
OWASP Top 10 / ASVS
SAST / DAST / SCA
API Security
Mobile Security
Kubernetes & Container Security
Infrastructure Security
Vulnerability Management
Incident Response
SIEM/SOAR
IAM / RBAC / MFA / PAM
Zero Trust Architecture
Security Automation

Cloud & Infrastructure

Google Cloud Platform (Preferred)
AWS / Azure
Linux & Windows Hardening
Docker & Kubernetes
Networking & Firewalls

Security Tools

Experience with one or more:

CrowdStrike, SentinelOne, Microsoft Defender
Google SecOps, Splunk, Microsoft Sentinel, QRadar
Tenable, Qualys, Rapid7
Checkmarx, Veracode, Snyk, GitGuardian
Burp Suite
CyberArk, Okta, Microsoft Entra ID

Preferred Certifications

CEH
Security+
CISA
CISM
CISSP
OSCP
Google Professional Cloud Security Engineer
AWS Security Specialty

Key Performance Indicators (KPIs)

Area	KPI
Application Security	100% SSDLC compliance across all projects
ISO/IEC 27034	Successful implementation and certification readiness
Secure Releases	100% security gate compliance before production deployment
Vulnerability Management	100% Critical vulnerabilities resolved within SLA
Cloud Security	≥95% compliance with cloud security baselines
Infrastructure Security	≥95% infrastructure hardening compliance
Security Testing	100% SAST, DAST and SCA coverage for production applications
Incident Response	Critical security incidents responded within defined SLA
Compliance	Zero Major Audit Non-Conformities
Customer Security	Timely closure of customer VAPT and compliance observations
Security Awareness	Quarterly secure coding and security awareness sessions completed

Success Profile

The successful candidate will:

Champion Security-by-Design across the engineering organization.
Lead implementation of ISO/IEC 27034 Application Security and support ISO/IEC 27001 ISMS certification.
Build a mature DevSecOps capability with automated security controls.
Strengthen cloud, application, infrastructure, and healthcare cybersecurity posture.
Ensure continuous compliance with national and international healthcare security regulations.
Collaborate effectively with Engineering, QA, DevOps, Product Management, SRE, Infrastructure, and Compliance teams to deliver secure, resilient, and compliant healthcare products.

Capability Area	Must Have	Good to Have
1. Application Security & Secure SDLC	Information Security experience with practical exposure to Application Security, Secure SDLC/SSDLC, OWASP Top 10/ASVS, Threat Modelling, Secure Coding and Security Assessments. Hands-on understanding of API and Mobile Application Security.	Experience with ISO/IEC 27034, ASMP/ONF/ASC, OWASP SAMM, secure architecture reviews, SBOM/CBOM and application security maturity assessment.
2. DevSecOps & Security Testing	Good practical understanding of DevSecOps and CI/CD security, including SAST, DAST and SCA, vulnerability remediation and VAPT processes.	Hands-on experience with Secret Scanning, IaC Security, Container/Kubernetes Security, automated security gates and security automation.
3. Cloud, Infrastructure & Identity Security	Good understanding of Cloud Security, Infrastructure Security, IAM, RBAC, MFA, system hardening, networking and endpoint security.	Hands-on experience with GCP, AWS/Azure, Kubernetes, Docker, CSPM, PAM, Zero Trust, EDR/XDR and cloud security architecture.
4. Security Operations & Vulnerability Management	Practical exposure to Vulnerability Management, security monitoring, Incident Response, Risk Assessment and security remediation. Ability to coordinate VAPT and track findings through closure.	Experience with SIEM/SOAR, Google SecOps/Splunk/Sentinel, Threat Hunting, Threat Intelligence, ransomware response, cyber recovery and security automation.
5. Data Protection, Governance & Compliance	Working knowledge of ISO/IEC 27001, security risk management, audits, data protection, data classification and encryption. Understanding of protecting sensitive/healthcare data.	Experience with ISO/IEC 27034 certification, DPDP, HIPAA, GDPR, CERT-In, NABH, ABDM, DLP, database security and privacy assessments.
6. Collaboration & Security Leadership	Ability to work effectively with Engineering, QA, DevOps, SRE and Product teams to identify and remediate security risks. Strong communication, documentation and problem-solving skills.	Experience conducting secure coding training, security awareness programs, customer security assessments, vendor risk assessments and executive security reporting.
7. Emerging Technology Security	Awareness of security risks associated with cloud-native applications, APIs, modern software architectures and emerging technologies.	Hands-on exposure to AI/LLM, RAG, AI API security, NIST AI RMF, ISO/IEC 42001, Google SAIF and AI security testing.

Someone shared one job with you. ASAI keeps finding the rest.

Scored, not searched. Every role ranked against your actual profile.

Alerts as often as hourly. Reach new roles while the pile is still small.

Skill gaps, spelled out. See exactly which requirements you don't meet yet.

Verified jobs, only. Say no to ghost jobs. Your time deserves respect.