About the Role: This is a hands-on, implementation-focused role not an advisory one. You will spend most of your time finding real vulnerabilities, deploying real security controls, and securing real CI/CD pipelines and cloud environments. Our infrastructure is AWS-primary, and you will also help us introduce and secure additional, cost-optimized cloud and server environments as we grow. You will work directly with our product tech leads, our DevOps team, and an external security testing partner to take each product to a strong, audit-ready security posture. If you enjoy building and shipping security controls rather than only writing policy, this role is for you.

Key Responsibilities

- Application Security - Conduct threat modeling on real application architectures, data flows, and APIs, producing specific, actionable output.
- Perform vulnerability assessments and penetration testing on web applications and APIs; identify, prioritize, and track findings to closure.
- Perform secure code review and partner with developers to fix vulnerabilities, with attention to authentication, payment flows, data isolation, and PII handling.
- Define and enforce a secure-coding standard tailored to our stack (Python/Django, Node.js, React).
- Cloud Infrastructure Security (AWS-Primary, Multi-Cloud Capable) - Harden and continuously monitor our AWS environment (primary platform): IAM least- privilege, network segmentation, encryption, logging (CloudTrail), and threat detection (GuardDuty, Inspector, or equivalent).
- Implement and operate Cloud Security Posture Management CSPM to detect misconfigurations and drift across AWS and any additional providers we adopt.
- Apply portable, vendor-neutral security through Infrastructure as Code IaC (Terraform) and container/Kubernetes security, so controls travel with the workload regardless of provider.




- Manage secrets properly (AWS Secrets Manager / Parameter Store or HashiCorp Vault) and eliminate hardcoded credentials.
- Work with the DevOps team to introduce and secure additional, cost-optimized server environments (e.g., Azure or cost-focused providers), extending our security standards to each current platform.
- Administer Linux servers and cloud environments with security as the default; support uptime, scalability, and patching.
- DevSecOps Pipeline Security - Build and maintain security gates in CI/CD pipelines (Jenkins, GitHub Actions, or GitLab CI/CD): SAST, DAST, software composition analysis, container image scanning, and IaC scanning.
- Implement Infrastructure as Code security using Terraform or CloudFormation with automated policy checks (e.g., Checkov, Trivy).
- Deploy and validate developer-side security tooling and automate security tasks using Python and/or Bash.
- Monitoring, Incident Response Collaboration - Set up centralized logging and monitoring (CloudWatch, ELK, Prometheus, Grafana, or equivalent) with alerting and incident workflows.
- Define and run an incident response process; investigate and remediate security incidents.
- Work directly with tech leads, DevOps, QA, and developers to ensure controls are implemented, not just recommended.
- Coordinate an external security testing partner for periodic deep penetration testing, and drive their findings to closure.




- Compliance Audit Readiness - Build and maintain the security artifacts required during enterprise customer due diligence (security questionnaires, VAPT reports, data-handling documentation).
- Establish practices aligned with relevant standards e.g. OWASP and PCI-DSS / data-protection requirements where applicable.

Required Qualifications

- 5+ years hands-on experience in application security, cloud security, and/or DevSecOps, with controls you have personally implemented not only assessed or advised on.
- AWS expertise mandatory, primary. Deep, hands-on experience securing AWS environments.
- A second cloud required demonstrated. Hands-on experience securing at least one other provider Azure, GCP, or a cost-focused provider such as DigitalOcean,Hetzner, or OVH. This must be work you have actually delivered, not a willingness to learn.
- Portable, vendor-neutral skills.
- Strong Infrastructure as Code Terraform and container/Kubernetes security the skills that let security and workloads move safely between providers.
- Application security depth. Proven experience with threat modeling, VAPT, and secure code review on real applications and APIs.
- CI/CD and IaC security. Hands-on experience integrating security into pipelines and securing Infrastructure as Code Terraform CloudFormation.
- Containers. Working experience securing Docker and Kubernetes environments.
- Scripting. Practical Python and/or Bash for automation.
- Tooling. Familiarity with SAST/DAST/SCA tools, vulnerability scanners, CSPM, and monitoring stacks.
- Linux. Solid Linux system administration.
- Communication. Able to give a tech lead a clear, specific, prioritized list of what to fix and why.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 Senior Security Engineer (Maharashtra)
🏢 ARCITECH
📍 Maharashtra