Lead Security Engineer

About Navi

Navi is one of the fastest-growing financial services companies in India providing Personal & Home Loans, UPI, Insurance, Mutual Funds, and Gold. Navi's mission is to deliver digital-first financial products that are simple, accessible, and affordable. Drawing on our in-house AI/ML capabilities, technology, and product expertise, Navi is dedicated to building delightful customer experiences.

Founders: Sachin Bansal & Ankit Agarwal

Know what makes you a “Navi_ite” :

1. Perseverance, Passion and Commitment

Passionate about Navi’s mission and vision

Demonstrates dedication, perseverance, and high ownership

Goes above and beyond by taking on additional responsibilities

2. Obsession with high-quality results

Consistently creates value for the customers and stakeholders through high-quality outcomes

Ensuring excellence in all aspects of work

Efficiently manages time, prioritizes tasks, and achieves higher standards

3. Resilience and Adaptability

Adapts quickly to new roles, responsibilities, and changing circumstances, showing resilience and agility

We are seeking a lead security engineer to architect our overarching security strategy, build robust defenses, and lead our technical security operations. In this critical role, you will define enterprise-wide security policies, oversee the implementation of core defense mechanisms including Web Application Firewalls (WAF), and proactively identify risks through systematic threat modeling. You will bridge the gap between engineering, product, and executive teams, ensuring that security is a foundational element of our business operations. Overseeing the security posture across our infrastructure, applications, and cloud environments,

Security Architecture & Threat Modeling: Architect, deploy, and enforce robust security controls across cloud infrastructure (AWS/OCI), networks, and CI/CD pipelines. Lead comprehensive threat modeling exercises for new features and enterprise architectures to identify vulnerabilities and design mitigating controls before code is written.

Perimeter Defense & WAF Management: Deploy, manage, and continuously tune Web Application Firewalls (WAF), API gateways, and bot mitigation platforms to protect critical enterprise assets against Layer 7 attacks, DDoS attempts, and OWASP Top 10 vulnerabilities.

Strategic Leadership: Develop, implement, and maintain the organization's comprehensive security roadmap, aligning technical security initiatives with business objectives and compliance requirements.

Incident Management & Response: Direct the incident response team during critical security events, overseeing containment, eradication, forensic analysis, and executive post-mortem reporting.

Cross-Functional Collaboration: Partner directly with engineering directors and product managers to embed DevSecOps practices, acting as the primary security advisor for new product launches and major infrastructure changes.

Vulnerability & Risk Management: Oversee penetration testing, manage the bug bounty program, and lead continuous internal vulnerability management

Mentorship & Team Building: Direct day-to-day operations for the security engineering team, providing technical mentorship, conducting performance reviews, and fostering a culture of proactive defense.

AI-Driven Security : Build, evaluate, integrate, AI powered security tools to accelerate vulnerability detection. Design and implement security guardrails for Navi's in-house AI/ML infrastructure. Proactively identify and mitigate AI-specific attack vectors.

Experience: 8+ years of progressive experience in cybersecurity, application security, or infrastructure security

Technical Defenses: Hands-on expertise configuring and managing enterprise-grade Security tools.

Threat Intelligence & Risk: Proven expertise in enterprise threat modeling (e.g., STRIDE, PASTA), risk assessments, and leveraging frameworks like MITRE ATT&CK to proactively defend against advanced threats.

Architecture Proficiency: Advanced knowledge of cloud security architectures, container orchestration (Docker, Kubernetes), identity and access management (IAM/SSO), and zero-trust network principles.

Scripting & Automation: Strong proficiency in at least one language (e.g., Python, Go, Bash) to drive security automation, custom tooling, and infrastructure-as-code (IaC) security reviews.

AI/ML Security Expertise : Familiarity with emerging AI security frameworks (e.g., OWASP Top 10 for LLMs)

Position Summary

Key Responsibilities

Required Qualifications