How do I hire a security engineer in India on a small budget?
Key takeaways
- A full-time application security engineer in India is typically Rs 18 lakh to Rs 40 lakh a year, which is out of range for most pre-seed startups.
- A fractional security engineer at 3 days a week usually costs Rs 1,50,000 to Rs 3,00,000 a month, versus a similar full-time hire at Rs 1,50,000 to Rs 2,50,000 a month.
- A monthly incident-response and advisory retainer of Rs 15,000 to Rs 50,000 gives access to a senior responder without a headcount.
- An OSCP certification gets shortlisted faster, but a candidate's own bug bounty write-ups or a live demonstration of a real finding tells you more.
- Hire in Kochi, Pune, Bengaluru or Coimbatore rather than only Mumbai, because the same role commonly costs 20 to 30 per cent less outside the top metro.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Should I hire full-time, fractional or a firm?
Work through it in that order. A firm makes sense when the need is a defined deliverable, such as an audit, a test, or an incident. A fractional hire makes sense when the need is continuous, such as reviewing pull requests, running the pipeline, keeping the vulnerability backlog moving, and handling the audit conversation. A full-time hire only makes sense once you have something like 20 to 50 engineers and a steady stream of security work, because at ten people a full-time security engineer will be idle or, worse, will leave. The most common Indian startup pattern that works is a fractional engineer for six months, then a full-time hire when the pipeline justifies it.
What skills should I actually screen for?
Screen for capability, not for tools. Can this person find a broken access control bug in an unfamiliar codebase? Can they write a secure code review that a developer will accept rather than argue with? Do they understand cloud IAM and log pipelines well enough to configure them? Can they talk to customers and auditors without overclaiming? A 60-minute practical exercise works better than a CV: give them a small slice of your own code, or a deliberately vulnerable sample, and ask them to talk through what they would do. A good candidate will ask what the threat model is. A weak one will reach for a scanner and read the output. Certificates such as OSCP or CISSP help with filtering, not with the decision.
How do I compare salary expectations fairly?
Compare total cost, not headline salary. A full-time AppSec engineer in India runs roughly Rs 18 lakh to Rs 40 lakh a year depending on city, level and whether the role is mostly code review or mostly cloud and detection work. A fractional hire at three days a week is usually Rs 1,50,000 to Rs 3,00,000 a month, sometimes with an equity or retainer trade. A retainer firm is Rs 15,000 to Rs 50,000 a month. Add the cost of the interview loop, the time to onboard and the productivity dip while the person learns your codebase, which is usually 4 to 8 weeks. A city outside Mumbai, Bengaluru and Delhi routinely costs 20 to 30 per cent less for the same seniority, and Kochi, Pune and Coimbatore all have credible senior candidates.
How do I make sure they are actually good, cheaply?
Use a paid, scoped trial. Pay for a 2 to 4 week engagement, usually at the fractional or contract rate, with a defined deliverable: a review of the top 20 pull requests, a threat model of one service, or a pre-launch test. Paid trials cost a fraction of a bad hire and filter out candidates who will not do the work. Check two references from real engagements, and ask what the previous team did differently after they arrived, because that is the measure of a good security hire. Also agree a written scope for the first 90 days, so both sides know what good looks like before the emotion of a hiring decision settles in.
| Route | Indicative cost | Suits |
|---|---|---|
| Monthly advisory and incident retainer | Rs 15,000 - Rs 50,000 a month | Early stage, needs a named responder on call |
| Fractional engineer at 3 days a week | Rs 1,50,000 - Rs 3,00,000 a month | Continuous code review and pipeline work |
| Contract-to-hire, 6-12 months | Rs 1,50,000 - Rs 2,50,000 a month | Testing a candidate before a full-time commitment |
| Full-time AppSec engineer | Rs 18,00,000 - Rs 40,00,000 a year | 20+ engineers and a steady security backlog |
What are the frequently asked questions?
Get a straight answer on this
Send us the role you need covered and the days per week, and we will propose a fractional or retainer plan with a fixed monthly cost.
Send us the details See pricing