How long does the SecureLayer7 careers process take from first call to offer?

Median two weeks for security roles, two-and-a-half for sales and engagement. Founders-round feedback within two business days.

Is the CTF round really original?

Yes — SecureLayer7 builds the challenges and rotates them every quarter. Categories cover web exploit chains, API auth bypass, source-code review, and Active Directory primitives.

Does SecureLayer7 sponsor visas?

Senior security and senior engineering roles into the Austin office: yes. Other roles: case-by-case. The India entity hires across cities, with Pune as the headquartered office.

Can non-security people apply for operations or sales?

Yes. Two of five open roles are non-technical. The discipline exercise tests the actual skills the role requires, not credentials.

What does week one look like at SecureLayer7?

Day one: laptop, accounts, a team buddy. Week one: pair with two researchers (security roles) or shadow two customer calls (engagement / sales). End of week two: ship your first artifact.

Does SecureLayer7 respond to every application?

Yes. Slowly during peak hiring weeks but always. Out-of-cycle portfolios are kept on file.

Careers

Find what the world missed.

We build offensive security from research to revenue.

Pentesters publish CVEs. Engineers build BugDazz Autonomous. Engagement leads scope the work. Sales names the threat. Operations keeps researchers in flight. Every role ends in the same artifact: an exploit, a patch, a receipt.

The work —

What you would actually do.

Six disciplines, one proof chain — research to retest, exploit to patch, sale to renewal.

Research
Find what others miss.
Reverse-engineer software no one else looked at this year. Chain primitives into working exploits. Publish CVEs that name us. Researchers chained CVE-2024-3400 three weeks before public disclosure — the day-one standard.
Engineering
Ship BugDazz Autonomous.
Build BugDazz Autonomous — the pentest engine that runs web apps, APIs, and Active Directory on a customer-set schedule. Tools, infra, integrations, plumbing.
Engagement
Scope before testing.
Run kickoffs with CISOs and platform leads. Translate findings into language regulators sign off on. Pruthvi and Munmun own this — calls, SOWs, the memo that goes to the board.
Sales
Proof, not pitch decks.
Open conversations with security leads at fintechs, banks, healthcare, telecoms, SaaS. The buyers who want artifacts, not templated PDFs.
Operations
Keep researchers in flight.
Equipment. Visas. Conference travel — DEF CON, Black Hat, OWASP, BSides. The work needs the room to happen.
Customer success
Land remediation, not findings.
The report lands as work in the right team's queue. The retest passes. The next engagement is scoped before the renewal.

Open positions —

Roles open right now.

Live from our hiring portal. Apply opens the role on sechire.net — resume, scheduling, references handled there.

Department

Location

Mode

5 of 5 roles

Hiring process —

Five rounds. No surprises.

01
Screening
Thirty minutes. Why us, why now, what you have shipped. A pod lead listens more than they ask.
02
Track exercise
Original CTF for security · code review for engineering · scoping sim for engagement · discovery practice for sales. Two hours.
03
Discipline interview
Talk through your exercise with the team you would work alongside.
04
Cross-functional
Meet the adjacent team — the discipline-gap test.
05
Founders
Sandeep and leadership. Offer within five business days.

Median timeline: two weeks. Two-and-a-half for sales and engagement.

What you get —

Real comp. Real time to do the work.

Standard line items, written so you know what the offer actually means before you walk into the founders chat.

Compensation: Set against the local market for the role.
Benchmarked to local market data, reviewed yearly. Equity for senior hires.
Conference + training: DEF CON, Black Hat, OWASP, BSides — talks too.
Security track: DEF CON, Black Hat, OWASP, BSides — registration and travel covered. Engineering: pick the technical conferences. Other tracks: same per-head budget, your call on the event.
Research time: A quarterly cadence, not a 20% project.
Pentesters get protected weeks each quarter for original research that ships as a CVE or a public writeup.
Equipment: Whatever the work needs.
A working laptop. Lab hardware for IoT and hardware research. Replaced on the team's standard refresh cycle.
Health + leave: We do not measure adults by attendance.
Medical, dental, vision in each office. Parental leave, PTO, sick leave on each office's local policy.
Office or remote: Austin and Pune are real offices.
People show up. Specific roles are remote — that is noted on the role itself.

The offer letter spells every line out as a number or a policy reference.

Third-party signal —

What people who've worked here actually say.

Public, anonymous, third-party. Numbers come from Glassdoor's own dashboard for SecureLayer7.

4.7Glassdoor ratingACROSS 108 REVIEWS

93%Would recommendTO A FRIEND
4.6Work-life balanceIT INDUSTRY AVG 3.8
88%Positive outlookON THE BUSINESS, 12-MO

Where we work —

Two cities, one team.

Austin and Pune. Pentesters, researchers, and engagement leads work from both — local hires, local hours.

Austin · Texas, USA
14:18CST
Pune · Maharashtra, India
00:48IST

On record —

The work earns its own credentials.

14 years of offensive research. Every claim backed by a live CVE or a proven exploit.

CREST

Accredited company + accredited testers

CERT-In

Empanelled auditor — India

SOC 2 Type II

AICPA Trust Services

ISO/IEC 27001

Information Security Management

Mapped to engagement requirements across

SOC 2 Type IIPCI DSSHIPAAISO 27001GDPRNIST CSFFedRAMPand others

FAQ —

Processquestions.

Show all 6 questions

Don't see your role? Tell us what you would build here. info@securelayer7.net

Find what the world missed.

We build offensive security from research to revenue.

What you would actually do.

Find what others miss.

Ship BugDazz Autonomous.

Scope before testing.

Proof, not pitch decks.

Keep researchers in flight.

Land remediation, not findings.

Roles open right now.

Red Team Operator

Security Consultant

Application Security Engineer

Associate Security Consultant

Enterprise Cybersecurity Sales

Five rounds. No surprises.

Screening

Track exercise

Discipline interview

Cross-functional

Founders

Real comp. Real time to do the work.

Set against the local market for the role.

DEF CON, Black Hat, OWASP, BSides — talks too.

A quarterly cadence, not a 20% project.

Whatever the work needs.

We do not measure adults by attendance.

Austin and Pune are real offices.

What people who've worked here actually say.

Two cities, one team.

The work earns its own credentials.

Processquestions.

Find what the world missed.

We build offensive security from research to revenue.

What you would actually do.

Find what others miss.

Ship BugDazz Autonomous.

Scope before testing.

Proof, not pitch decks.

Keep researchers in flight.

Land remediation, not findings.

Roles open right now.

Red Team Operator

Security Consultant

Application Security Engineer

Associate Security Consultant

Enterprise Cybersecurity Sales

Five rounds. No surprises.

Screening

Track exercise

Discipline interview

Cross-functional

Founders

Real comp. Real time to do the work.

Set against the local market for the role.

DEF CON, Black Hat, OWASP, BSides — talks too.

A quarterly cadence, not a 20% project.

Whatever the work needs.

We do not measure adults by attendance.

Austin and Pune are real offices.

What people who've worked here actually say.

Two cities, one team.

The work earns its own credentials.

How long does the process take from first call to offer?

Is the CTF round really original, or is it CTF-time-of-old?

Do you sponsor visas?

I don't have a security background — can I apply for operations or sales?

What does week one look like?

Do you respond to every application?