- Position Summary

As DevSecOps Lead – Product Security & Compliance, you will make sure every product FutureCraft builds is secure by design and compliant from day one. You will embed security into our development lifecycle and CI/CD pipelines, secure our applications, APIs, smart contracts and cloud workloads, and turn compliance requirements (SOC 2, ISO 27001, PCI-DSS, GDPR, DPDP Act) into automated controls.

You will work hands-on with Engineering, Product and the Cloud & IT Infrastructure team, and grow a small security engineering function as the company scales. This role is key to earning the trust of enterprise and BFSI clients.

- Key Responsibilities

•

Secure SDLC & CI/CD o

Embed security checks into every pipeline: SAST, DAST, SCA, secrets scanning, container and IaC scanning.

o

Define security gates and quality thresholds that block risky releases without slowing delivery.

o

Secure the software supply chain: dependency management, image signing, SBOMs and artifact provenance.

•

Product & Application Security o

Run threat modelling and security design reviews for recent features, services and APIs.

o

Define secure coding standards, authentication/authorization patterns and encryption practices for product teams.

o

Coordinate penetration tests, smart-contract audits and bug bounty findings; track remediation to closure.

•

Cloud Workload Security o

Secure Kubernetes, container and serverless workloads across AWS, Azure and GCP.

o

Manage secrets and keys (Vault, KMS, Key Vault) and enforce least-privilege IAM for applications.

o

Run cloud security posture management and policy-as-code guardrails with the Cloud & IT Infrastructure team.

•

Compliance Automation o

Translate SOC 2, ISO 27001, PCI-DSS, GDPR and DPDP Act requirements into technical controls for our products.

o





Automate evidence collection and continuous compliance monitoring; support external audits.

o

Maintain data classification, logging, retention and privacy controls in our applications.

•

Vulnerability Management & Incident Response o

Own vulnerability triage and fix SLAs across code, dependencies, containers and cloud workloads.

o

Set up security logging and SIEM alerts for products; lead investigation of product security incidents.

•

Enablement & Leadership o

Train developers on secure coding and run security champions across product teams.

o

Answer client security questionnaires and support enterprise security reviews.

o

Hire and mentor security engineers as the function grows.

- Skill Set Required

•

DevSecOps Tooling: SonarQube, Snyk, Checkmarx, OWASP ZAP/Burp Suite, Trivy, Checkov, Gitleaks

•

CI/CD: GitHub Actions, GitLab CI, Jenkins or Azure DevOps

•

Application Security: OWASP Top 10 and API Top 10, OAuth2/OIDC, JWT, encryption, threat modelling (STRIDE)

•

Cloud & Container Security: AWS/Azure/GCP security services, Kubernetes security, Wiz/Prisma Cloud, OPA/Kyverno

•

Secrets & Keys: HashiCorp Vault, AWS KMS/Secrets Manager, Azure Key Vault

•

Compliance: SOC 2, ISO 27001, PCI-DSS, GDPR, DPDP Act; compliance automation (Vanta/Drata or similar)

•

Monitoring & SIEM: Splunk, Microsoft Sentinel, ELK, AWS Security Hub

•

Coding & Scripting: Python,



Bash and ability to read Go, Java, JavaScript/TypeScript or Solidity code

- Qualifications & Experience

•

Experience

o

6–10 years in DevSecOps, application security or security engineering roles o

Proven record building secure CI/CD pipelines with integrated security testing o

Hands-on experience securing cloud-native applications (containers, microservices, APIs)

o

Experience implementing controls for SOC 2, ISO 27001 or PCI-DSS audits o

Experience working with developers to fix vulnerabilities at the source

•

Education

o

Bachelor's or Master's degree in Computer Science, Information Security or a related field

•

Certifications (Preferred)

o

AWS Certified Security – Specialty or equivalent Azure/GCP security certification o

CKS (Certified Kubernetes Security Specialist)

o

OSCP, GWAPT or CSSLP o

CISSP or CCSP o

ISO 27001 Lead Implementer

- Preferred Qualifications

•

Experience in blockchain, cryptocurrency or digital asset security, including smart-contract security

•

Background in fintech or BFSI with RBI or SEBI regulatory exposure

•

Experience securing AI/ML systems and data pipelines

•

Experience running bug bounty or responsible disclosure programs

•

Contributions to security communities, open-source security tools or published research

- What We Offer

•

A key role shaping the security of FutureCraft's blockchain-AI platform from the ground up.

•

Competitive compensation, performance bonuses and equity grants.

•

Access to cutting-edge hardware (NVIDIA H200 clusters) and generous cloud credits.

•

Professional development, certifications and conference sponsorship.

•

A collaborative, innovation-driven culture at our Pune headquarters

📌 DevSecOps Lead (Pune)
🏢 Growing Careers
📍 Pune