Senior Product & Cloud Security Engineer – AWS, Application Security & Penetration Testing

Company: Triaxa FZCO

Location: Remote / Hybrid (India timezone preferred)

Employment Type: Full-time

Experience: 5+ years

Role Type: Hands-on Individual Contributor

About Triaxa

Triaxa develops cloud-native technology platforms built on microservices, distributed systems, APIs, and AWS infrastructure.

We are looking for a Senior Product & Cloud Security Engineer to assess and strengthen the security of our applications, cloud environments, APIs, and software delivery infrastructure. You will conduct authorized penetration testing, investigate incidents, guide remediation, and verify that vulnerabilities have been resolved.

Key Responsibilities

Application & API Security

- Assess and penetration test web applications, REST APIs, backend services, and microservices.
- Identify authentication weaknesses, broken access controls, privilege escalation, injection, insecure sessions, and sensitive data exposure.
- Review OAuth 2.0, OpenID Connect, JWT, API keys, RBAC, and service-to-service authentication.
- Validate tenant isolation in SaaS applications.
- Review security-sensitive code and architecture.
- Test file uploads, input validation, rate limiting, account recovery, and business logic.
- Apply OWASP Top 10 and OWASP API Security Top 10 guidance.

AWS Cloud & Infrastructure Security
- Assess AWS environments, including IAM policies, IAM Identity Center, cross-account access, privileged roles, and trust relationships.
- Review EC2, VPC, EKS, ECR, S3, RDS, Secrets Manager, and KMS configurations.
- Identify excessive permissions, exposed services, misconfigurations, and network segmentation weaknesses.
- Review security groups, subnet isolation, administrative access, encryption, secrets management, and key rotation.
- Verify infrastructure hardening and remediation.

Penetration Testing & Vulnerability Management
- Plan and execute authorized penetration tests within approved scopes.
- Perform attack-surface discovery, manual vulnerability validation, and controlled exploitation.
- Assess privilege escalation, lateral movement, authentication bypass, and unauthorized data access risks.
- Prioritize findings by exploitability, exposure, business impact, and CVSS severity.
- Produce reports with reproducible evidence and practical remediation guidance.
- Maintain a vulnerability register with affected assets, severity, owners, and remediation status.




- Coordinate remediation with engineering teams and independently retest fixes.

DevSecOps & CI/CD Security
- Assess Jenkins, GitHub Actions, Docker, Kubernetes, and CI/CD pipelines.
- Identify exposed credentials, insecure build agents, excessive deployment permissions, and software supply-chain risks.
- Implement and improve SAST, DAST, software composition analysis, secret scanning, and container image scanning.
- Review Terraform and infrastructure-as-code configurations.
- Integrate security checks, deployment controls, and approval mechanisms into development workflows.

Security Monitoring & Incident Response
- Investigate suspicious cloud activity, unauthorized access, credential compromise, and infrastructure incidents.
- Analyze CloudTrail, CloudWatch, GuardDuty, Security Hub, and application security logs.
- Support incident containment, evidence preservation, root-cause investigation, and recovery validation.
- Identify attack paths, persistence mechanisms, and control failures.
- Develop incident response procedures and escalation guidelines.

Kubernetes, Container & Linux Security
- Assess Kubernetes/EKS RBAC, service accounts, workload identities, network policies, and secrets.
- Identify vulnerable images, excessive runtime privileges, container misconfigurations, and exposed interfaces.
- Review Linux hardening, patching, SSH security, and administrative access.
- Evaluate workload isolation and security controls for distributed microservices.

Data Protection & Platform Security
- Review security across databases, caches, storage, and messaging systems.
- Assess encryption in transit and at rest, access policies, sensitive logging, and secrets exposure.
- Validate webhook security, request signing, replay protection, and service integrations.
- Review customer data isolation and third-party integration risks.

Security Governance & Reporting
- Establish security review checklists and minimum requirements for new services and releases.
- Track high-risk findings, recurring issues, and overdue remediation.




- Report security posture and remediation progress to technical leadership.
- Recommend controls that support security, reliability, and engineering productivity.

Required Skills & Experience
- 5+ years of hands-on security engineering experience.
- AWS security architecture, IAM, VPC, CloudTrail, GuardDuty, Security Hub, KMS, and Secrets Manager.
- Web and REST API security, authentication, authorization, and OWASP guidance.
- Manual penetration testing, controlled exploitation, attack-path analysis, and remediation verification.
- Burp Suite, OWASP ZAP, Nmap, and vulnerability assessment tools.
- Jenkins, GitHub Actions, SAST, DAST, software composition analysis, and secret scanning.
- Docker, Kubernetes/EKS, container scanning, and workload isolation.
- Linux hardening, networking, TLS, firewalls, and secure administration.
- Incident investigation, security log analysis, and evidence preservation.
- Clear technical reporting and effective collaboration with engineering teams.
- Responsible testing practices and adherence to authorization boundaries.

Good to Have
- Java/Spring Boot microservices security.
- Kafka, MongoDB, PostgreSQL, Redis, and distributed application experience.
- Multi-tenant SaaS security.
- SMTP security, email delivery platforms, and abuse prevention.
- Terraform, infrastructure-as-code scanning, and cloud security posture management.
- Semgrep, CodeQL, Trivy, Checkov, Gitleaks, or equivalent tools.
- Threat modeling and security architecture reviews.
- Familiarity with ISO 27001 or SOC 2 controls.
- OSCP, PNPT, BSCP, AWS Certified Security – Specialty, or equivalent hands-on expertise.

What Success Looks Like
- Critical and high-risk vulnerabilities are addressed within agreed timelines.
- Application and AWS security controls are regularly assessed.
- Findings include reproducible evidence, and remediation is independently verified.
- Security validation is integrated into development and release workflows.
- Leadership has transparent visibility into risks and remediation progress.

Hiring Process Shortlisted candidates will complete a practical technical evaluation covering:
- AWS IAM and cloud security.
- Web application and REST API penetration testing.
- Jenkins/GitHub Actions CI/CD security.
- Kubernetes and container security.
- Incident investigation and log analysis.
- Vulnerability reporting and remediation verification.

📌 Senior Product & Cloud Security Engineer – AWS, Application Security & Penetration Testing (India)
🏢 Triaxa - FZCO
📍 India