Navi

Overview

We are seeking a proactive and technically curious Security Engineer I to join our product security team. In this role, you will be on the front lines of defending our products, focusing heavily on Vulnerability Assessment and Penetration Testing (VAPT) across our web applications, mobile apps (iOS/Android), and backend APIs.

About Navi

At Navi, our mission is to simplify finance for a billion people, through technology-first products built at scale. Founded in 2018 by Sachin Bansal and Ankit Agarwal, Navi has grown rapidly across Loans, UPI, Insurance, Mutual Funds and Digital Gold.

Requirements & Eligibility

• 0–2 years of experience in application security, penetration testing, or software engineering (including strong internships, bug bounty experience, or intensive cybersecurity programs).
• Hands-on understanding of the OWASP Top 10 (Web and Mobile) and the ability to manually exploit common vulnerabilities.
• Strong proficiency in Python (or similar languages like Go, Ruby, or Bash).
• Familiarity with standard penetration testing tools such as Burp Suite, OWASPZAP, Postman, Nmap, or mobile-specific tools like MobSF.
• Solid understanding of how the web works (HTTP/HTTPS, TCP/IP, DNS), API architectures and basic mobile application structures (APKs/IPAs).

Key Responsibilities

• Conduct routine VAPT on web applications, REST/GraphQL APIs, and mobile applications (iOS and Android) to identify security flaws before they reach production.
• Design, write, and maintain custom scripts and automation tools (primarily in Python, or another preferred language like Go/Bash) to streamline vulnerability scanning, log parsing, and reporting workflows.
• Review alerts from automated security scanners (SAST/DAST), filter out false positives, and manually validate suspected vulnerabilities.
• Work directly with software engineering teams to clearly communicate the impact of identified vulnerabilities and provide actionable remediation guidance based on the OWASP Top 10.
• Assist in integrating, configuring, and tuning open-source and commercial security testing tools within our deployment pipelines.
• Draft clear, concise penetration testing reports detailing attack vectors, proofs of concept (PoCs), and mitigation strategies.