Security Engineer

Company Description VipraTech Labs is a forward-thinking technology startup specializing in end-to-end product development, security, automation, and AI-driven workflows. The company builds complete solutions, from backend to frontend, with a focus on secure, testable, and scalable code. VipraTech designs and delivers efficient products and tools while prioritizing automation of operations and AI-enhanced innovation. The team is committed to working closely with startups across regions such as NZ, AUS, SEA, Middle East, EU, and the US, offering personalized, hands-on partnership with a focus on accountability and ROI. VipraTech also invests in nurturing talent, particularly in core development, AI, and cybersecurity. Role Description As a Security Engineer – Python (AppSec Tooling & Integrations) you will turn security research and real-world testing needs into reliable, reusable Python automation . You’ll build scripts/services/CLIs that automate checks, parse results, and publish normalized findings; wrap third-party scanners and APIs behind clean adapters; and package everything into Dockerized jobs that run predictably in CI/CD and our backend pipelines. You will collaborate closely with team to convert techniques into low-false-positive tooling, add logging/metrics, and document usage so others can operate your work without hand-holding. The role is hands-on and delivery-focused: small PRs, clear acceptance criteria, scope discipline, and readable code with tests and docstrings. You’ll participate in design/code reviews, improve reliability/performance, and help evolve our starter kits and internal libraries. This is an onsite, Kota position with a strong learning culture—expect fast feedback, weekly demos, and growth toward owning modules and mentoring juniors. What you’ll do Build Python scripts, services, and CLI tools to automate security checks, data collection, and reporting. Integrate external tools (scanners/APIs/CLIs) into Dockerized workflows; write Python adapters/wrappers for consistent I/O. Develop parsers/matchers to turn raw outputs (HTTP/JSON/HTML/logs) into normalized findings and lightweight reports. Orchestrate jobs (scheduling, retries, parallel runs); add logging/metrics andbasic error handling. Contribute to secure, maintainable code: small PRs, unit tests, docstrings/READMEs, and simple design notes. Collaborate with security researchers/engineers to translate techniques into repeatable, low-false-positive automation. Support CI/CD by adding linters/tests and packaging your code for reliable, reproducible runs. Participate in code reviews; suggest improvements inperformance, reliability, and security hygiene. Qualifications Must-have Python proficiency: solid fundamentals (data structures, OOP, typing), HTTP clients (requests/ parsing (BeautifulSoup/lxml/json/regex), CLI tooling (argparse/click), packaging/virtualenv/Poetry. Web & protocols: HTTP/HTTPS basics, cookies/sessions, headers/CORS, REST/JSON, simple auth flows (tokens/Basic). Security foundations: OWASP Top 10 concepts (XSS/SSRF/SQLi/Auth/IDOR), input validation/encoding, least privilege, secrets handling, logging for security. Tooling & automation: Linux shell, Docker (build, multi-stage, compose), Git/GitHub flow, write Python wrappers/adapters around external tools/APIs. Quality & reliability: unit tests/pytest, reproducible runs, basic error handling/retries, docstrings/README, small PR discipline. Collaboration: clear written communication, comfort with ticketing (Jira/Linear), code reviews, following acceptance criteria and scope. Good-to-have Security tools exposure: Burp Suite (extensions/Intruder), Nmap/NSE, one of ZAP/Semgrep/Trivy/Bandit, secrets scanners. Concurrency & performance: asyncio/threading/process pools; batching, back-pressure; basic profiling. Data & stores: SQLite/Postgres basics, Redis/queues for job orchestration. CI/CD basics: linters (ruff/flake8), formatters (black), simple GitHub Actions or similar. Framework awareness: basic Django/FastAPI (routes, deps, auth), simple service endpoints. Cloud familiarity: fundamentals on any one cloud (AWS/Azure/GCP)—IAM basics, container run, logs/metrics. Networking: ports/protocols, DNS/HTTP debugging, TLS/mitm basics (Burp/mitmproxy). Security mindset: threat modeling lite, reducing false positives, safe handling of test payloads; responsible disclosure etiquette. Plus points: prior bug-bounty write-ups/tools, CTFs, open-source contributions; relevant certs (eJPT, PNPT, OSCP, CEH) are a bonus—not mandatory. Education/Experience Bachelor’s in CS/IT or equivalent or strong portfolio/GitHub demonstrating Python tooling. 0–2 years for entry/junior; we value proof of work over years.