Senior Code Auditor - Application Security & Code Review

SENIOR CODE AUDITOR — APPLICATION SECURITY & CODE REVIEW

Experience: 6+ years

Salary: ₹1,25,000+ per month (based on skill and experience)

Location: 515, Gera Imperium Rise, Opposite Wipro, Hinjewadi Phase 2, Pune

Type: Full-time, on-site

ABOUT US

We build and run software that handles real money and real client data — a SaaS platform, client platforms we maintain, and a mobile app, across Laravel, MySQL/PostgreSQL and Ubuntu servers. Security here isn't a checkbox exercise — production systems have faced real attack attempts, and we take that seriously.

THE ROLE

This role owns security code review across our codebases — not a one-time audit, an ongoing practice. You go through the code the way an attacker would, not the way a linter would: authentication, authorisation, business logic around money and credits, API security, dependency risk, the works. If something is exploitable, we need to know before someone else finds it first.

WHAT YOU WILL DO

• Run deep security code reviews across our Laravel/PHP codebases — injection, auth, authorisation/IDOR, XSS, CSRF, file upload, SSRF, deserialisation, and everything in between

• Pay special attention to business-logic flaws — anything touching money, balances, credits or payments, since that's where real damage happens, not just in the obvious places

• Review API security, secrets management, dependency risk, and configuration/deployment across our Hostinger and DigitalOcean-hosted servers

• Review the Flutter mobile app's security posture, not just the backend

• Document every finding properly — file, location, plain explanation, exploit path, real impact, and a working fix, not a vague suggestion

• Set priorities by how easily an attacker could actually use the flaw, not textbook severity ratings

• Work across multiple live projects, keeping context straight on each one instead of treating every review the same

• Build repeatable review processes and checklists so security isn't only as good as whoever's paying attention that week

• Advise on hardening — auth/session handling, secrets, server and web-server config, database security, rate limiting, logging and monitoring

• Be honest in every report — never call something secure that hasn't actually been verified

WHAT WE ARE LOOKING FOR

• 6+ years in application security or security-focused senior development — real production experience, not a certification-only profile

• Deep, hands-on knowledge of the OWASP-class vulnerability set — injection, auth/authz, XSS, CSRF, SSRF, deserialisation, IDOR — and how each actually gets exploited, not just defined

• Real experience with PHP/Laravel security specifically; comfortable across MySQL and PostgreSQL

• Understands financial/transaction-system security — balances, credits, payment flows — where a logic bug is as dangerous as an injection flaw

• Has investigated a real breach or incident before, not only performed scheduled audits

• Comfortable working from a short brief and figuring out the rest — this is not a role where every step gets spelled out

• Can write a finding a non-technical founder can understand, and a fix a developer can paste in and ship

• Discreet — what you find in this code does not leave this room

BONUS POINTS

• Experience securing crypto, wallet or payment-gateway integrations specifically

• Experience with Flutter/mobile app security

• Familiarity with Cloudflare WAF and server-side hardening on Ubuntu/Linux

• Prior incident-response or digital-forensics experience

WHAT THIS ROLE IS NOT

• Not a QA or code-style review job — this is security, not linting

• Not a one-time audit and done — this is ongoing, across live projects

• Not a role for someone who needs constant direction — you're expected to know the job

HOW TO APPLY

Send us:

1. Resume

2. Current salary, expected salary, notice period

3. A 3-4 line write-up of one real vulnerability you found and fixed — what it was, how it could've been exploited, and what you did (no client names or confidential details, just the technical story)

Pay: ₹70,000.00 - ₹100,000.00 per year

Work Location: In person