India, Security Engineer

The role

You will secure the product and platform that run Sycamore's enterprise agents. The surface spans user-facing applications, APIs, agent runtimes, tools and connectors, identity and authorization, untrusted code execution, multi-tenant data, cloud infrastructure, and the software-delivery system itself.

This is a hands-on engineering role. You will write production code, build security controls and paved paths, review designs and code, model threats, test systems from an attacker's perspective, investigate incidents, and work with engineers until durable fixes reach production.

Agent systems introduce unusual security problems. A model may consume hostile instructions from a document, invoke tools on a user's behalf, generate executable code or browser content, retain information in memory, and operate across long-running workflows. Securing that system requires more than a conventional web checklist: identity must remain attributable, authority must narrow at every boundary, untrusted content must stay contained, credentials must remain outside model context, and high-impact actions must be observable and governable.

All jobs

India, Security Engineer

Sycamore, Bengaluru

The role

What you will do

Lead threat modeling and security architecture for agent products, APIs, connectors, execution environments, customer applications, and platform services.
Build production security controls for authentication, authorization, delegated agent identity, workload identity, credential brokering, tenant isolation, encryption, policy enforcement, and auditability.
Design isolation boundaries for untrusted code and generated content, including sandboxing, network and resource controls, browser containment, and safe communication with trusted services.
Identify and remediate vulnerabilities through design review, code review, targeted security assessment, hands-on exploitation, and adversarial testing.
Develop reusable libraries, services, policies, test harnesses, and developer tooling that eliminate vulnerability classes rather than documenting the same mistake repeatedly.
Secure the software-development lifecycle through dependency verification, secret detection, code and infrastructure scanning, build isolation, artifact integrity, and risk-based release gates.
Build security telemetry, detections, investigation tools, containment paths, and response automation across application, identity, agent, and infrastructure events.
Participate in incident response from triage and containment through root-cause analysis, remediation, evidence preservation, and control improvement.
Establish practical vulnerability-management practices with clear severity, exploitability, ownership, remediation, verification, and exception handling.
Partner with Product and Core AI on risks specific to agentic systems, including prompt injection, confused deputies, excessive agency, unsafe tool calls, memory poisoning, sensitive-data leakage, and model-generated executable content.
Partner with Infrastructure on cloud and cluster security, network boundaries, workload identity, secrets, data protection, deployment safety, and customer-controlled environments.
Translate enterprise security requirements into defensible engineering controls and evidence without allowing questionnaire-driven work to replace actual risk reduction.
Raise the security capability of the engineering organization through clear design patterns, direct coaching, useful reviews, incident learning, and tools engineers want to use.

What you need

5-12 years of software or security engineering experience. We will make exceptions for exceptional people in either direction.
Strong software-engineering fundamentals and evidence that you have built, shipped, and operated security-relevant production systems—not only assessed them.
Depth in at least two of product security, application security, identity and authorization, cloud or infrastructure security, platform security, software supply chain, offensive security, or detection and response.
Experience threat-modeling complex systems, finding realistic failure paths, and translating them into proportionate controls and executable tests.
The ability to review code and architecture, reproduce vulnerabilities, build reliable tooling or services, and verify that remediation actually closes the issue.
Strong understanding of trust boundaries, least privilege, identity, authorization, secrets, cryptography, isolation, secure software design, and common web and distributed-systems vulnerabilities.
An attacker's curiosity paired with a builder's judgment. You can demonstrate how a system fails, but your work is not finished until the safer path works in production.
Practical risk judgment. You distinguish plausible impact from theoretical concern, prioritize the highest-leverage work, and avoid both security theater and reckless shortcuts.
A collaborative approach that raises engineering velocity and ownership rather than turning Security into a late-stage approval queue.
Clear written and verbal communication. You can explain a subtle exploit to an engineer, a control gap to leadership, and an evidence-backed posture to a customer's security team.
AI-native. You use modern AI systems and coding agents to expand your coverage while independently validating findings, exploitability, and remediation.
Comfort with startup ambiguity, broad ownership, and occasional customer travel.

Experience securing AI or agent systems is valuable but not required. Engineers from strong product-security, platform-security, identity, cloud-security, developer-security, offensive-security, or security-focused software-engineering backgrounds can succeed here if they are excited to learn the agent-specific threat model.

India, Security Engineer

The role

India, Security Engineer

The role

What you will do

What you need

The environment you will work in

Interview process

About Sycamore

About Sycamore

Why join

Similar jobs at other companies

Software Engineer, Security Agents

Security Engineer - Application Security (Senior)

Sr. Security Engineer

Software Engineer, Security

Security Engineer

Platform Security Engineer

Sycamore