Remote-first (India)
Adalat AI is a nonprofit building software and AI for justice systems. Our products help courts work with proceedings, documents, and legal information. We need engineers who can protect sensitive data while keeping these workflows reliable and usable.
Role Overview
We are looking for a Senior Security Engineer to take hands-on ownership of application security across our products and services. You will trace how a request moves through the system, identify where trust can fail, and work with engineers to ship and verify fixes.
Your work will span browser applications, backend APIs, real-time speech and collaboration services, document processing, and the infrastructure boundaries around them. You will work with the CTO, application, platform, ML, and QA teams.
Key Responsibilities
Review designs and code: Threat-model sensitive workflows and review changes early enough to influence implementation. Cover login, session lifecycle, password recovery, invitations, document access and sharing, uploads, downloads, and administrative actions.
Test authorization thoroughly: Assess REST, GraphQL, WebSocket, and service-to-service paths for missing or inconsistent controls. Build tests for cross-user and cross-organization access, revoked permissions, expired credentials, and unintended anonymous access.
Find, fix, and verify vulnerabilities: Reproduce findings safely, explain impact, write or pair on production fixes, and add regression tests. Follow changes through deployment and retesting, including checking that legitimate workflows still function.
Lead internal security training: Decide what training materials engineering teams need to follow. Come up with security best practices and ensure that they are established within teams.
Build useful security automation: Introduce and tune code, dependency, secret, container, and configuration checks in CI/CD. Make findings actionable and use regression tests and secure shared components to prevent recurring classes of bugs.
Partner on infrastructure boundaries: Work with platform and SRE engineers on least privilege, workload identities, secrets rotation, storage access, private internal endpoints, and separation of production, testing, and research.
Support response and disclosure: Triage researcher reports, investigate relevant evidence, support containment and recovery, and document remediation. Share practical guidance with engineers.
Qualifications
10+ years of experience. Atleast 5+ years of security focussed work
Strong experience securing production web applications and APIs, with examples of vulnerabilities you understood and helped fix.
Ability to read unfamiliar code and write maintainable fixes or security tooling in at least one backend language. Our relevant stack includes Go, TypeScript/JavaScript, and Python; you should be willing to work across it.
Depth in HTTP and browser security, authentication and authorization, session handling, API abuse, and common application vulnerability classes.
Practical experience with manual testing and tools such as an intercepting proxy, code scanners, or equivalent custom tooling. You can validate results and explain false positives.
Working knowledge of cloud IAM, Linux, containers, CI/CD, and secrets management, sufficient to follow an application issue across infrastructure boundaries.
Clear technical writing, disciplined handling of sensitive data, and the ability to take a finding from discovery to verified closure with other engineers.
Useful additional experience
GraphQL, WebSockets, multi-user collaboration, and document-level access controls.
Applied cryptography and key management reviews using established libraries and protocols.
Kubernetes, Azure or GCP, and infrastructure as code.
SOC 2 or ISO 27001 implementation and audit preparation.
Work with sensitive public-sector, legal, financial, or healthcare information.
Benefits and Perks
WFH with flexible work hours.
Unlimited PTO.
Autonomy and ownership.
Learning & development resources — including certifications relevant to this role.
Smart, humble, and friendly peers.
Maternity and paternity leaves.
Contacts within the Harvard / MIT / Oxford ecosystem.