Principal Security Engineer

Job Summary

This role sits at the intersection of cloud-native engineering and security, operating across AWS in a data-intensive, high-throughput payments workplace. You will drive deep architecture, engineering, and automation across Cloud Infrastructure and Product Engineering teams — owning security architecture, security engineering, and the security observability layer.

You will actively partner across product and infrastructure layers to uplift the cyber resilience of Tazapay's platform, while product-managing security tooling and building security observability capabilities on top of internal product offerings. This is a hands-on, high-ownership role that demands equal parts technical depth and cross-functional leadership.

Location: Bangalore

Reporting To: CISO

Key Responsibilities

Architecture

- Actively participate in and contribute to the Architecture Review, providing security-informed, opinionated guidance on technology choices across software engineering and infrastructure patterns.

- Author and champion RFC-style technical documents, architectural decision records (ADRs), and implementation guides for adoption by product and infrastructure engineering teams.

- Shape Tazapay's API strategy with strong ownership over Security, Privacy, and Governance pillars — including API authentication standards, rate limiting, and threat modeling for API surfaces.

- Collaborate closely with architecture, product management, product engineering, and GRC teams in a hands-on environment to design, build, and operate products securely.

- Work independently with developers, system engineers, and product managers to ensure security and privacy-first design and development reviews across all product and infrastructure initiatives.

- Own and maintain a living security design mandate — documenting architectural standards, security controls, and implementation patterns — and drive adoption across product and infrastructure groups.

- Independently research, evaluate, and prototype emerging security technologies; develop proof-of-concepts and present findings to the broader engineering community to accelerate informed adoption.

- Design and develop enterprise IAM architecture aligned with business and security objectives, including authentication and authorization frameworks using SAML, OAuth 2.0, OpenID Connect, LDAP, and Kerberos.

- Lead the implementation and integration of IAM solutions across enterprise applications, cloud platforms, and infrastructure.

- Own threat modeling as a structured practice across product and infrastructure — embedding it early in the SDLC and establishing repeatable threat modeling frameworks for engineering teams.

- Design and evolve a Zero Trust architecture across Tazapay's multi-cloud environment — spanning network access, identity verification, device trust, and micro-segmentation.

Engineering and Automation

- Build security automation tooling with a developer-first lens — prioritizing self-serviceability, low friction, and high developer empathy as foundational design principles.

- Partner with DevOps and Infrastructure teams to embed security verification gates — including SAST, SCA, secrets scanning, container scanning, and IaC policy checks — natively into CI/CD pipelines.

- Own the product management, engineering, and operations of security tooling spanning CI/CD, product, infrastructure, identity, user endpoint, and SaaS partner layers.

- Own the product management, engineering, and operations of security monitoring capabilities across the edge — encompassing both Layer 7 (WAF, API gateway, bot protection) and Layer 4 (DDoS, network-level) security controls.

- Lead detection engineering efforts to continuously tune, enrich,



and improve alert fidelity across the detection and response layer — reducing false positives and improving mean time to detect (MTTD) across infrastructure and product layers.

- Drive security control parity and tooling consolidation across all merged and acquired entities, ensuring unified threat management coverage and consistent security posture.

- Define and own the vulnerability management program — covering triage, SLA enforcement, prioritization frameworks, and remediation tracking across infrastructure and application layers.

- Govern secrets and key management practices across the organization — including PKI, certificate lifecycle, cryptographic standards, and secrets management tooling such as HashiCorp Vault or AWS Secrets Manager.

- Own software supply chain security — including SBOM generation, dependency risk assessment, and third-party library governance — to mitigate supply chain attack vectors.

Operations Management

- Own security operations budget governance — tracking approved spend, run rate, and unit economics — and drive cost optimization without compromising coverage or operational effectiveness.

- Manage relationships with managed security service providers (MSSPs) and vendors, holding them accountable to SLA adherence, service quality benchmarks, and continuous improvement commitments.

- Define and own incident response playbooks, coordinate with the SIRT during active incidents, and lead post-incident reviews to drive systemic improvements.

- Define and track security engineering KPIs — including mean time to remediate (MTTR), vulnerability aging, pipeline gate pass/fail rates, and detection coverage — and present findings to IT leadership and executive stakeholders.

Automation and Tooling

- Lead automation initiatives across Security and GRC functions to streamline compliance reporting, evidence collection, dashboarding, and audit workflows — materially reducing audit fatigue.

- Lead automation initiatives to reduce manual effort in vulnerability management, including automated scanning, triage, ticketing integration, and SLA tracking.

- Drive adoption of policy-as-code and automated configuration verification across AWS

Culture and Enablement

- Champion adoption of Agile practices within the Security team, embedding sprint-based delivery, backlog management, and continuous improvement ceremonies.

- Build a product mindset within all members of the security team — encouraging ownership, metrics-driven thinking, and user empathy.

- Mentor and coach security engineers on architecture mindset, secure design principles, and career progression pathways.

- Foster a Security and Privacy by Design culture within product engineering — embedding shift-left security practices, threat modeling early in the SDLC, and making security a shared engineering responsibility.

- Design and deliver a structured developer security awareness program covering secure coding practices, OWASP Top 10, common vulnerability patterns, and threat modeling techniques.

Customer Engagement and Compliance

- Represent Tazapay's security posture in customer-facing engagements, articulating security maturity, control effectiveness, and tooling adoption with clarity and confidence.

- Lead security capability walkthroughs and evidence presentations during internal and external audits including ISO 27001, SOC 1/2, and PCI-DSS assessments, as well as enterprise customer security evaluations.





- Architect and maintain regulatory compliance controls aligned to PCI-DSS, ISO 27001, and applicable data protection regulations — ensuring controls are engineering-driven and continuously validated rather than point-in-time.

Must Have Requirements

- 123+ years of progressive experience as a security architect, product security engineer, or full-stack software engineer, with deep domain ownership in security within cloud-native, data-intensive environments.

- Proven experience as a security architect or product security engineer, with strong software engineering fundamentals — preferably in Golang, Java or equivalent — and deep working knowledge of information security principles and secure development practices.

- Operational knowledge of cloud service offerings across AWS, GCP, or Azure with focus on securing environments at design, deployment, and runtime layers.

- Deep understanding of CI/CD and DevOps practices, with hands-on experience in release management, branching strategy, pipeline governance, and embedding security checkpoints across the engineering lifecycle.

- Deep understanding of web applications, data architecture, and microservice architecture — including REST and GraphQL API security.

- Experience in microservices adoption and transformation, and building engineering governance models with a focus on API security.

- Strong command of application security best practices and design principles including OWASP Top 10, Secure SDLC, and threat modeling methodologies.

- Knowledge of common security implementations across authentication, authorization, database security, network security, encryption, logging and monitoring, error handling, and gateway products.

- Hands-on experience with IAM architecture and protocols including SAML, OAuth 2.0, OpenID Connect, LDAP, and Kerberos.

- Exceptional communication skills — written and verbal — with the ability to translate complex technical security risks into clear, business-aligned, risk-based narratives for engineering, product, and executive audiences.

- Proven experience coaching and mentoring security engineers, and operating effectively as a cross-functional team leader.

- Experience operating using Agile methodologies and tools including JIRA and Confluence.

Nice to Have (Technical)

- AWS, GCP, or Azure security certifications (e.g., AWS Security Specialty, Google Professional Cloud Security Engineer, Microsoft SC-100).

- Domain experience in payments, banking, or platform-based products — particularly in regulated environments.

- Security-specific certifications such as CISSP, CCSP, CSSLP, or CEH.

- Experience with observability and SIEM platforms such as Splunk, Datadog, or Chronicle Security.

- Familiarity with supply chain security tooling, SBOM generation, and dependency governance frameworks.

- Exposure to Zero Trust architecture frameworks and implementation patterns (e.g., BeyondCorp, NIST SP 800-207).

- Experience with bug bounty program management or red team/penetration testing program oversight.

- Custody, Wallet and Key Management Security - Architect hot, warm, and cold wallet security models — defining signing workflows, quorum policies, key rotation schedules, and hardware security module (HSM) integration.

- Architect controls to meet stablecoin-specific regulatory obligations across MAS (Singapore), and applicable jurisdictions.

- Define and own incident response playbooks for crypto-native attack scenarios — including smart contract exploits, private key compromise, bridge hacks, oracle attacks, and stablecoin de-pegging events.

- Lead post-exploit forensics including on-chain transaction tracing, attacker fund flow tracking, and coordination with exchanges and bridges for asset freezing where possible.

📌 Principal Security Engineer (Bengaluru)
🏢 Recognized
📍 Bengaluru