Cybersecurity Engineer

Job Description

Company: Turium AI
Location: Hyderabad, India
Employment Type: Full-time | On-site
Experience: 2–5+ years (exceptional hackers with less experience are encouraged to apply)
Department: Cybersecurity & Engineering

About Turium AI

Turium AI is building the next generation of enterprise artificial intelligence, intelligent automation, ERP, and secure digital platforms.

Our technologies support government agencies, large enterprises, and mission-critical operations. We build and operate AI-powered applications, cloud-native infrastructure, data platforms, and enterprise systems where security, privacy, and resilience are fundamental.

We are looking for an exceptional Cybersecurity Engineer who thinks like a hacker, attacks like a red teamer, and defends like a security architect.

We don't want someone who simply runs vulnerability scanners, prepares compliance reports, or follows security checklists.

We want someone who can break into our systems (with authorisation), discover weaknesses before real attackers do, and engineer the protections that make those attacks fail.

The Mission

Your mission is simple:

Hack us before the real hackers do.

You will continuously challenge the security of Turium's products, infrastructure, applications, APIs, AI systems, and internal networks.

You will work directly with our engineering, platform, infrastructure, and AI teams to identify vulnerabilities, simulate sophisticated attacks, fix weaknesses, and build resilient security controls.

This is a hands-on engineering position, not a governance-only or compliance-focused role.

You must be equally comfortable finding an exploit, writing code, reviewing architecture, investigating suspicious activity, and deploying a permanent fix.

Key Responsibilities

1. Offensive Security & Ethical Hacking

• Conduct authorised penetration testing across web applications, mobile applications, APIs, cloud infrastructure, and internal systems.
• Discover and demonstrate vulnerabilities such as SQL injection, authentication bypass, broken access controls, SSRF, RCE, XSS, insecure deserialisation, and privilege escalation.
• Perform red-team exercises simulating realistic attacker behaviour.
• Test identity systems, SSO, OAuth 2.0, OIDC, SAML, passkeys, and authentication workflows.
• Identify weaknesses in network segmentation, Kubernetes environments, containers, and cloud configurations.
• Develop custom security testing tools, scripts, exploit proofs of concept, and automated attack simulations.
• Investigate attack paths and demonstrate how multiple weaknesses could be chained together.
• Assess third-party integrations, software dependencies, and supply-chain security risks.

2. Defensive Security Engineering

• Design and implement security controls that prevent, detect, and contain attacks.
• Harden Linux servers, Kubernetes clusters, containers, databases, APIs, and cloud infrastructure.
• Deploy and optimise WAF, IDS/IPS, EDR, SIEM, and runtime protection capabilities.
• Implement effective secrets management, encryption, key rotation, least-privilege access, and zero-trust security controls.
• Strengthen network security, segmentation, firewall policies, and service-to-service authentication.
• Build automated security checks into CI/CD pipelines.
• Work with developers to eliminate root causes rather than simply patch individual vulnerabilities.

3. Threat Detection & Incident Response

• Proactively investigate suspicious activities, logs, network traffic, and security alerts.
• Develop detection rules for credential theft, privilege escalation, lateral movement, data exfiltration, and other malicious behaviour.
• Conduct threat hunting across production and corporate environments.
• Investigate suspected compromises and perform initial forensic analysis.
• Support incident response, containment, eradication, recovery, and post-incident improvements.
• Automate detection and response workflows to reduce exposure and response time.

4. AI & LLM Security

Turium is developing sophisticated AI products and autonomous agents. You will help secure these emerging technologies.

• Perform adversarial testing against LLM-powered applications and AI agents.
• Test for prompt injection, jailbreaks, tool-call abuse, data leakage, and insecure AI workflows.
• Evaluate risks involving MCP servers, agent permissions, external tools, and autonomous actions.
• Identify security vulnerabilities in RAG pipelines, vector databases, model-serving infrastructure, and data integrations.
• Design guardrails, isolation controls, authorisation policies, and monitoring for AI systems.
• Research emerging AI attack techniques and develop appropriate defences.

Required Skills & Experience

We care more about demonstrated technical ability than certificates or job titles.

• Strong hands-on experience in ethical hacking, penetration testing, or offensive security engineering.
• Deep understanding of Linux, networking, TCP/IP, DNS, TLS, HTTP, and modern web security.
• Strong knowledge of OWASP Top 10, OWASP API Security Top 10, and common exploitation techniques.
• Practical experience using Burp Suite, Nmap, Wireshark, Metasploit, Nuclei, and similar security tools.
• Ability to write working security automation and testing tools using Python, Go, Bash, or equivalent languages.
• Experience assessing cloud and Kubernetes security configurations.
• Solid understanding of authentication, authorisation, encryption, and secure application design.
• Ability to analyse logs, investigate suspicious behaviour, and understand attacker techniques.
• Strong knowledge of MITRE ATT&CK and real-world attack patterns.
• Ability to explain vulnerabilities clearly and work with engineers to deliver effective remediation.
  

Highly Desirable

• Experience in bug bounty programs, responsible vulnerability disclosure, or security research.
• Published CVEs, original security research, GitHub security projects, or demonstrated CTF achievements.
• Red-team experience in enterprise or cloud environments.
• Experience developing SIEM detection rules and security automation.
• Knowledge of AWS security, Kubernetes security, and infrastructure-as-code scanning.
• Experience with AI/LLM security testing and OWASP guidance for LLM applications.
• Familiarity with ISO 27001, ISO 42001, the Australian Government ISM, IRAP, and the Essential Eight.
• Relevant qualifications such as OSCP, OSWE, OSEP, CRTO, or equivalent demonstrated expertise.
  

What Makes You Exceptional

We are particularly interested in engineers who:

• Have discovered serious vulnerabilities that automated scanners missed.
• Can demonstrate how a real attacker would compromise a complex system.
• Enjoy CTFs, exploit development, reverse engineering, and security research.
• Understand both offensive techniques and how to build practical defences.
• Can independently investigate an attack and implement a lasting solution.
• Continuously experiment, learn, and challenge assumptions.
• Prefer terminal access, code, and hands-on testing over endless presentations.
• Take responsible disclosure, customer privacy, and authorised testing boundaries seriously.
  

What Success Looks Like

First 30 days

• Understand Turium's security architecture, systems, and critical assets.
• Establish an initial attack-surface inventory.
• Identify and prioritise the most significant security weaknesses.
• Produce a practical remediation roadmap.

First 60 days

• Conduct authorised penetration tests across priority applications and infrastructure.
• Work with engineering teams to remediate critical and high-risk findings.
• Improve security monitoring, threat detection, and incident response readiness.
• Establish repeatable security testing processes.

First 90 days

• Implement automated offensive security testing and continuous validation.
• Deliver realistic red-team exercises and demonstrate defensive improvements.
• Establish measurable security engineering practices across the SDLC.
• Help create a culture where security is continuously tested, engineered, and improved.
  

Why Join Turium AI?

This is an opportunity to work on real-world security challenges across enterprise AI, government technology, distributed infrastructure, and next-generation intelligent systems.

You will have:

• Direct access to engineering and technology leadership.
• Opportunities to influence architecture and security decisions.
• Real ownership of offensive and defensive security engineering.
• Exposure to advanced AI systems, cloud infrastructure, and mission-critical enterprise applications.
• A technically ambitious environment where demonstrated skill and initiative matter.
  

How to Apply

Don't just send us a resume. Show us what you can do.

Along with your application, share any relevant examples of:

• A significant vulnerability you discovered and responsibly reported.
• A security tool, script, or exploit proof of concept you developed.
• A bug bounty finding, CTF achievement, or security research project.
• A complex security issue you investigated and helped resolve.

Please ensure examples do not expose confidential information or vulnerabilities without authorisation.

Position: Cybersecurity Engineer – Offensive & Defensive Security
Location: Hyderabad, India (On-site)

Our hiring philosophy:

We don't need someone who tells us we're secure. We need someone who can prove where we're not — and make us stronger.

Hack Turium. Defend Turium. Stay ahead of the attackers.