World leading global engineering consultancy has vacancy in the security division for a CNAPP lead in a global role

CNAPP Security Engineer

Wiz platform engineering- Cloud Application Protection Platform

Department: Security Engineering | Reports to: Head of Security Engineering

Location Bangalore | Employment type Perm

Role purpose

We are seeking a Senior Cloud Security Engineer to own the deployment, engineering and continuous improvement of Wiz across our cloud estate. You will turn cloud risk findings into tested controls, automated workflows and verified fixes, working with Cloud Engineering, DevSecOps, IAM, Security Operations and application teams. The initial technology focus is Microsoft Azure and Oracle Cloud Infrastructure.

You will be a senior individual contributor within Security Engineering, responsible for the technical quality, coverage and effectiveness of the Wiz service.

Key responsibilitiesDeploy and maintain CNAPP & Wiz Platforms

· Implement cloud onboarding across Azure subscriptions and OCI tenancies and compartments. Establish repeatable deployment patterns, validate supported resource coverage and reconcile discovered assets against authoritative cloud inventories.

· Configure tenant access, projects, resource ownership, SSO and role based access. Maintain least privilege connector permissions and API credentials, monitor connector health and scan freshness, and resolve scanning or integration failures.

Engineer security controls

· Configure and tune posture, vulnerability and identity controls. Develop custom Cloud Configuration Rules using Rego, Security Graph queries and issue policies, with documented logic, representative test cases and controlled releases.

· Use the Wiz Security Graph to investigate attack paths and combinations of internet exposure, exploitable vulnerabilities, excessive permissions, secrets and sensitive data. Validate findings against the underlying cloud configuration and business context.

Deliver remediation and prevent recurrence

· Prioritise exposures using exploitability, asset criticality, external reachability, privilege and data sensitivity. Assign accountable owners, agree remediation deadlines and escalate material risks through the defined governance process.

· Develop and test fixes with cloud and application owners, including infrastructure as code changes, identity restrictions and network controls. Verify closure through rescanning and source configuration evidence, and address the causes of repeated findings.

Key responsibilities continuedBuild integrations and automation





· Develop maintainable automation using Python or PowerShell and the Wiz GraphQL API. Automate onboarding, ownership mapping, enrichment, evidence collection and reporting, with secure authentication, logging, error handling and version control.

· Integrate Wiz findings and relevant events with Microsoft Sentinel and the organisation’s ITSM and DevOps workflows using supported connectors or APIs. Implement deduplication, routing, escalation and status reconciliation so remediation can be tracked through verified closure.

Embed controls in development and cloud platforms

· Integrate licensed Wiz Code and CLI capabilities into Azure DevOps repositories and pipelines for infrastructure as code, container image, dependency and secrets checks. Coordinate coverage with existing application security scanners and agree proportionate release gates.

· Translate recurring findings into preventive controls within cloud platforms, reusable deployment templates and developer guidance. Maintain assessment of deployed resources so security visibility also covers resources created outside standard delivery workflows.

Extend workload and data coverage

· Assess security across virtual machines, containers, Kubernetes and serverless services, including identity, storage, networking and secrets exposure. Identify unsupported services and coverage gaps and agree compensating controls with the relevant teams.

· Where licensed and supported, implement data security posture management and Wiz Defend capabilities, including required sensors and log sources. Validate deployment impact, data handling and operating responsibilities before extending coverage.

· Provide cloud asset and attack path context to Security Operations during investigations. Agree escalation and handover procedures and work with existing endpoint, SIEM and cloud native security capabilities.

Provide governance and engineering enablement

· Produce technical and management reporting on coverage, scan health, critical attack paths, overdue exposure, remediation times, repeat findings and exceptions. Explain the risk and required action in terms appropriate to each audience.

· Map technical checks to relevant CIS, ISO 27001 and internal control requirements, including ITGC and SOX evidence where applicable.



Maintain documented exceptions with accountable owners, expiry dates and compensating controls.

· Maintain architecture records, operating procedures and a prioritised improvement backlog. Train engineering teams, manage technical escalations with Wiz and evaluate new capabilities against the organisation’s risks and requirements.

Essential experience and skills

· Demonstrable experience implementing and administering CNAPP platforms in particular Wiz in a production enterprise environment, including cloud connectors, access controls, policy configuration, finding investigation, integrations and remediation workflows.

· Robust hands on Azure security engineering experience covering Entra ID, Azure RBAC, managed identities, networking, storage, compute and cloud logging. Ability to apply these principles across a multi cloud estate.

· Practical understanding of cloud security posture management, cloud infrastructure entitlement management, vulnerability management and attack path analysis, with examples of reducing material risk.

· Experience authoring or adapting Wiz custom controls and queries, including Rego or comparable policy as code skills, and validating that controls identify the intended risks.

· Ability to build and support automation using Python or PowerShell, APIs, JSON and Git. Experience integrating security tooling with ITSM, SIEM or engineering delivery platforms.

· Experience reading and changing infrastructure as code using Bicep, ARM or Terraform, and integrating security checks into Azure DevOps or a comparable CI/CD platform.

· Working knowledge of container, Kubernetes and serverless security, including workload identities, exposed services, image vulnerabilities and secrets handling.

· Ability to investigate findings, propose practical fixes, work through technical disagreements and communicate clearly with engineers, risk owners and leadership.

Desirable experience

· Multi-cloud security engineering experience across IAM policies, compartments, dynamic groups, virtual cloud networks and native security services; experience supporting Wiz coverage

· Microsoft Sentinel, KQL and Defender for Cloud integrations; ServiceNow or Jira remediation workflows; enterprise asset inventories and ownership data.

· Wiz Code, Wiz Defend, data security posture management, sensitive data exposure analysis or security assessment of cloud hosted AI services.

· Large or regulated cloud estates, control assurance and audit evidence; relevant Wiz training, cloud security certifications or CCSP.

📌 CNAPP / Wiz Security Engineering Lead (Bengaluru)
🏢 AtkinsRéalis
📍 Bengaluru