Security & Compliance · Nashik (HQ, Maharashtra) · Full-time
Security Engineer
Protect customer audit evidence and tenant isolation across our AWS environment, mobile apps and integrations, and keep our SOC 2 Type II program running.
Gazi Wellness stores audit evidence that franchisors rely on in disputes with franchisees: photos, GPS coordinates, capture timestamps, scores and corrective action history. That evidence has to be isolated per franchise system, protected from tampering and available when a customer needs to export it.
You will report to Sameer Joshi, Head of Security & Compliance, and work across engineering. The role is hands-on: cloud security, application security reviews, detection and response, and the controls evidence for our annual SOC 2 Type II examination.
What you will do
- Own AWS security baselines across accounts in us-east-1 and ap-south-1: IAM, network controls, encryption and logging.
- Run threat modeling and security reviews for new features, including mobile sync, integrations and the public API.
- Build and tune detection and alerting, and lead incident response exercises.
- Maintain evidence hashing and audit-log integrity controls for customer audit records.
- Manage vulnerability scanning, dependency updates and the coordination of annual penetration tests.
- Answer customer security questionnaires and support enterprise security reviews.
What you bring
- 4+ years in security engineering, cloud security or application security.
- Strong hands-on AWS security experience (IAM, KMS, CloudTrail, GuardDuty or equivalents).
- Ability to read and review code in TypeScript or Python.
- Experience operating controls for SOC 2 or ISO 27001.
Nice to have
- Mobile application security experience on iOS and Android.
- Experience with SAML SSO and SCIM provisioning.
- Security certifications such as OSCP, AWS Security Specialty or CISSP.