A product of Security Brigade

Careers at B-52

B-52 is built and run by Security Brigade Infosec Pvt Ltd, an assessment firm working from Mumbai. Security Brigade is the employer for every role on this product, which means the group careers page carries the openings for the whole company and this page carries the B-52 ones.

Security Brigade openings How the platform was built

Open roles

No B-52 vacancies are open at the moment

Nothing is listed here because nothing is open, not because the list has not been filled in yet. Every role that works on B-52 is employed by Security Brigade Infosec Pvt Ltd, so when a B-52 vacancy opens it appears on this page and on the Security Brigade careers page at the same time, from the same record.

Until then the group page is the one worth checking. It carries the current openings across the whole company, including the assessment practice the platform is built out of, and a role there is a role at the same employer in the same office.

See the group openings Send a CV without a vacancy

The work

Three ends of one job, and they are not separate teams

Worth reading before you decide whether the group page is for you. This is what people here spend their time on, described as it is and not as a role we would like to fill.

Where it starts

The assessment practice

What it is: Senior auditors at Security Brigade run enterprise assessments, and have done since the firm started in 2006. That practice is the source material for everything the platform does.
The four things it works through: Mindmap creation, test-case generation, comprehensive JavaScript analysis and functional flow analysis, run in full on every target rather than sampled down to fit the hours available.
Why it is not separable from the product: B-52 was written out of that practice, so the work of improving the practice and the work of improving the platform are the same work done from two ends.

How a run happens

The platform

What it is: An agentic harness that takes an authorised scope, maps the target, generates the test cases that target needs, works them through, and chains what it proves.
The boundary it holds: Three actions stop and wait for written approval: destructive or state-changing actions, persistence and movement past the entry host, and live credentials or real customer data.
The constraint that shapes it: Eleven coverage classes, one platform-wide exclusion, and an approval boundary identical in all three delivery models. Autonomy is a scoping problem before it is a modelling one.

Before it reaches anyone

Verification and reporting

What it is: QA is the sixth phase and it runs on the finished report, before the report reaches the customer. In the expert-verified model a senior auditor checks every finding first.
What a finding has to carry: The request and the response that produced it, the steps to reproduce it, a severity with its CVSS v4.0 vector, and the CWE. What is reported is what the platform could exploit.
What that makes the job: Deciding what counts as proof, and holding that line. It is the part of the work that decides whether a report is worth the time it takes a customer to read.

The longer version is on the site itself, written for buyers and not for candidates but accurate either way: how a run is put together, where the autonomy stops, and why an assessment firm built its own tester.

Where roles are listed

One record, more than one page

Two lists that disagree with each other is the usual failure here, so they are not two lists. Both pages read the same published vacancies from the same place and filter them differently.

How a vacancy reaches this page

A vacancy is created once and tagged to the product it belongs to: Security Brigade, ShadowMap or B-52.
This page lists the vacancies tagged to B-52. It shows nothing else, and today that set is empty.
The Security Brigade careers page lists every published vacancy across the group, because Security Brigade Infosec Pvt Ltd is the employing entity for all three products.
Nothing is copied between the pages by hand, so a role cannot be open on one and missing from the other.
Applications are handled by Security Brigade in every case, whichever page the role was read on.
Every group vacancy is also listed on securityjobs.co.in, a free job board Security Brigade runs for the Indian security industry, alongside openings from other security teams.

Deliberately excluded

Pay. No vacancy record on this system carries a salary range today, so no page invents one. Where a figure exists it comes up in the conversation, not on a careers page.
Anything about future hiring. A plan that is not a vacancy is not on this page in any form.

Group vacancies are also listed on securityjobs.co.in, a free job board Security Brigade runs for the Indian security industry.

The openings are on the group page

Same company, same office, same people who wrote the practice B-52 runs. If a B-52 role opens, it will be listed here too.

Security Brigade careers Talk to the team