Principal Security Engineer

Sarvam is unusually direct about what this job is not: the posting says in plain words that it is not an audit management role, and that you will be designing architectures, finding vulnerabilities and shipping fixes. The premise is bringing the threat modelling discipline of Indian banking and fintech security to AI infrastructure, platforms and products. Scope covers security strategy and architecture, product and application security including authentication, access control and data isolation for AI products and APIs, adversarial testing and red teaming, and DevSecOps work securing cloud infrastructure, identity and access management and secrets, with security checks built into CI and CD. The requirement list is refreshingly practical: capture the flag participation and bug bounty work, especially private programmes, count as evidence.

Sarvam publishes no years of experience figure on this posting, so none has been recorded here rather than guessing. The title is Principal and the posting describes a hands on security leader, so expect it to be pitched senior.

Required: hands on experience securing enterprise and BFSI or fintech infrastructure; participation in capture the flag competitions across web, crypto, pwn or mixed categories; and participation in bug bounty programmes, especially private programmes for fintech, cloud or infrastructure companies.

The day to day breaks into four areas. Security strategy and architecture: defining and evolving the end to end security strategy, designing secure architectures for Sarvam's products and API platform, applying BFSI grade threat modelling to AI infrastructure, and making pragmatic risk decisions that balance research velocity against security. Product and application security: leading threat modelling for AI products, APIs and data systems, owning application and API security including authentication, access control and data isolation, and driving vulnerability discovery, remediation and verification. Systems and process: building systems to proactively find and validate vulnerabilities, performing targeted adversarial testing and red teaming, and researching emerging threats relevant to AI systems. Cloud and DevSecOps: securing cloud infrastructure, IAM and secrets management, integrating security checks into CI and CD without slowing teams down, and improving detection and response readiness.

Location is Bengaluru. Good fit if you are an offensive minded security engineer with fintech depth who wants to stay technical. Not a fit if your background is governance, risk and compliance: the posting rules that out itself.