Senior Security Engineer

Razorpay is one of Indias leading full-stack financial technology companies powering the way businesses move manage and grow money. Founded in 2014 by Harshil Mathur and Shashank Kumar with a simple vision to simplify payments for Indian businesses weve since grown into a fintech powerhouse driving Indias digital payment revolution.

Razorpay powers millions of businesses with a smarter scalable stack that goes beyond transactions to help them truly build and grow.

From seamless checkouts to payroll automation across India Singapore and Malaysia weve been engineering a fintech ecosystem thats redefining how money moves across Asia and were just getting started.

Today that ecosystem supports everyone from early-stage startups to some of Indias largest enterprises enabling them to accept process and disburse payments at scale while expanding into new ways of managing money more efficiently.

Our scale speaks volumes: Razorpay processes $180 billion in annualized transactions powering leading businesses like Airbnb Facebook WhatsApp Airtel CRED BookmyShow Zomato Swiggy Lenskart Mirae Asset Capital markets Indian Oil National Pension Scheme and over 100 of Indias unicorns. With strong roots in India and growing operations in Southeast Asia we are shaping the next chapter of financial technology across the region.

We are backed by global investors including GIC Peak XV Partners (formerly Sequoia Capital India & SEA) Tiger Global Ribbit Capital Matrix Partners MasterCard and Salesforce Ventures having raised over $740 million to date. Strategic acquisitions including Ezetap (POS and offline payments) Curlec (Malaysia expansion) BillMe (digital invoicing) and POP (rewards-first UPI) along with earlier moves in fraud prevention payroll and lending have further strengthened our platform and widened our footprint across Asia.

But what truly sets Razorpay apart is our culture. At Razorpay ownership is our oxygen you own what you build with no micromanagement or red tape just the runway to make your ideas fly. Learning is a lifestyle if youre curious youll feel at home here. People > Pedigree we hire for attitude hustle and hunger more than degrees. Transparency thrives over titles this is where interns question CXOs and CXOs say thank you. Guided by our values of Customer First Autonomy & Ownership Agility with Integrity Transparency Challenging the status quo and a strong belief that Razorpay grows with Razors youll be part of a 3000 strong team building not just products but the financial infrastructure of the future.

Title: Senior Product Security Engineer

The Role:
Razorpay is looking for a Senior Application Security Engineer with solid experience inAppSec fundamentalssecure code review vulnerability discovery API security and
practical pentesting skills. The ideal candidate should also be able to perform basicthreat modeling for new features and understand the emerging risks from AI-driven
attack patterns.

Roles/Responsibilities:

• Perform application-level pentests across web mobile and backend services.
• Identify validate and help remediate vulnerabilities including OWASP Top 10API Top 10 and logic flaws.
• Conduct security assessments for identity flows API endpoints micro-services and internal tools.
• Review code (manual assisted) to detect common AppSec Security & Pentesting
• Perform application-level pentests across web mobile and backend services.
• Identify validate and help remediate vulnerabilities including OWASP Top 10API Top 10 and logic flaws.
• Conduct security assessments for identity flows API endpoints micro-services and internal tools.
• Review code (manual assisted) to detect common AppSec issues.

Threat Modeling (Basic)

• Perform threat modeling for new features:
• Identify data-flow risks
• Spot common misconfigurations
• Highlight authentication/authorization concerns
• Document potential abuse cases and propose simple actionable mitigations.

AI / LLM Security (Introductory)

• Understand the basics of AI-driven attack vectors: prompt manipulation dataleakage misuse of LLM-based features.
• Flag potential AppSec risks in AI-assisted workflows or model integrations.
• Support teams in implementing simple guardrails around AI/LLM usage.

Secure SDLC & Developer Productivity

• Integrate AppSec checks into CI/CD pipelinesSAST SCA secrets scanningbasic DAST.
• Support engineering teams with secure coding guidance and easy-to-consumeAppSec patterns.
• Help create developer-friendly standards checklists and best practices.

Tooling & Automation

• Write small scripts or utilities (Python/JS/Go) for repetitive security checks.
• Contribute to improving internal AppSec automation and dashboards.

Requirements:

• A Bachelor's degree in Computer Science Cybersecurity or a related field.
• A minimum of 5-8 years of experience in application security.
• Hands-on experience with offensive security practices and product securityvulnerability management.
• Practical pentesting experience with tools like Burp Suite ZAP Postman andcustom scripts.
• Basic working knowledge of threat modeling techniques (STRIDE-lite DFD-based reasoning or simple checklist-based models).
• Familiarity with AI/LLM security basics (prompt injection data leakage pathsoutput validation).
• Programming/scripting experience (Python/JS/Go preferred).
• Experience with AppSec tools in CI/CD.

Location: Bangalore