Payatu is hiring a Cloud Security Consultant who goes beyond detecting cloud risks to preventing them building AWS security guardrails, securing EKS workloads, and turning cloud security findings into proactive, automated defences.

What we look for outside work parameters?

- Your expertise is your primary qualification, not your degree or certification.
- Your publicly known contributions are your credentials.
- Papers you have written, tools you have developed are your references.
- Your write-up reflects your interests and ethics.
- Your published exploits, your CTF scores, and hall of fame listings are the testimonies of your work.
- Your research paper was published and presented at conferences.
- You are learning from the community and enthusiastically contributing back.
- Certifications like OSCP, CREST, OSWE, and similar are a plus if you’ve got them, but we don’t gatekeep on degrees or certifications.
- Bonus points for AI security skills, on either side of the fence - attacking AI systems or building smart automation around your own testing.

You are a perfect technical fit if:

- Own the security posture of Angel One Wealth's AWS workplace.
- Detect and prevent misconfigurations via CSPM.
- Build proactive guardrails to block risky changes before they reach production.
- Operate the XDR solution for cloud threat detection and response.
- Secure Kubernetes (EKS) workloads.
- Build-and-operate role implements controls, not just an advisory function.

How the everyday work looks like:

- Deploy, tune and operate a CSPM tool (AWS Security Hub, Wiz, Prisma Cloud, or similar)



across all AWS accounts.
- Continuously monitor for misconfigurations, drift, and non-compliant resources.
- Triage findings and drive them to closure with application/infra owners.
- Maintain compliance mapping against internal policy and SEBI CSCRF requirements.
- Design and implement preventive controls: AWS Organizations SCPs, Config rules, IAM permission boundaries, guardrails-as-code.
- Block or auto-remediate non-compliant resources at creation time, not after the fact.
- Build automated remediation playbooks for common misconfigurations (open security groups, public S3 buckets, unencrypted storage, overly permissive IAM roles).

Key Responsibilities — XDR / Threat Detection & Response /Kubernetes

- coordinate with CrowdStrike team for coverage and policy configuration and coordinate with SOC team ensure logs are received in SIEM solution.
- Cluster hardening per CIS Benchmarks for Kubernetes.
- Implement pod security standards / admission controls.
- Implement network policies.
- Enforce image scanning and signing in the CI/CD pipeline.
- Manage secrets properly (no hardcoded secrets in manifests)
- Runtime threat detection for containers.




- Partner with DevOps/platform engineering on security review of infrastructure-as-code (Terraform/CloudFormation).
- Maintain audit-ready evidence for VAPT, cyber audits, and regulatory reviews.
- Participate in on-call rotation for critical cloud security incidents.
- Support enforcement of the Cyber Resilience, ICS, and IT security policies as they apply to cloud infrastructure.

Required Skills & Experience:

- 3+ years in cloud security or DevSecOps, including 2+ years focused specifically on AWS.
- Hands-on production experience with a CSPM tool (AWS Security Hub/Config, Wiz, Prisma Cloud, Orca, or similar).
- Experience writing and enforcing AWS guardrails: SCPs, Config rules, IAM policy design, and/or policy-as-code (OPA/Rego, Sentinel).
- Experience operating an XDR or equivalent platform (CrowdStrike, SentinelOne, Microsoft Defender, Palo Alto Cortex XDR) — tuning and responding, not just consuming alerts.
- Solid working knowledge of Kubernetes security on AWS (EKS): RBAC, network policies, pod security, image scanning.
- Strong understanding of IAM, VPC networking, encryption (KMS), and logging (CloudTrail, VPC Flow Logs, GuardDuty).
- Comfortable with Infrastructure-as-Code (Terraform and/or CloudFormation) and scripting (Python or Bash) for automation.

Good to Have:

- AWS Certified Security – Specialty
- Certified Kubernetes Security Specialist (CKS)
- Experience in a SEBI-regulated or other regulated financial services environment
- Familiarity with SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF)

📌 Cloud Security Consultant (Bengaluru)
🏢 Payatu
📍 Bengaluru