About GauntletGauntlet builds an agentless security platform for AWS, Azure and Google Cloud. Security and engineering teams use it for cloud security posture management, compliance, software supply chain security (SBOM), AI security posture management and secret scanning. We're based in Bengaluru and are the team behind Deep Armor.

The roleWe're looking for a QAT engineer with 3+ years of experience to own the quality of our cloud security platform. You'll test the product end to end, from the APIs and scanners that check cloud accounts to the React dashboard our customers use every day.

You'll join a small engineering team where you'll build our test automation, shape how we release, and see the impact of your work directly. Along the way, you'll deepen your experience in cloud and security testing.

What you'll do

- Build and maintain API automation in Python with pytest and requests or httpx: authentication, permissions, validation, pagination, filters and error paths.
- Build end-to-end UI automation for the dashboard with Playwright or Cypress, with stable selectors and rapid, reliable runs.
- Verify scanner accuracy with fixtures, from mocked cloud APIs to deliberately misconfigured test resources, that prove each check reports PASS, FAIL or "cannot scan" exactly when it should.
- Test what security customers care about most: tenant isolation, role-based access, sign-in and MFA flows, API keys and signed uploads.
- Run tests in GitHub Actions on every pull request and release, publish reports, and quarantine and fix flaky tests.
- Run risk-based exploratory testing before releases, write bug reports engineers can act on, and track them to closure.
- Track quality signals such as escaped defects, flaky-test rate and coverage of critical journeys, and improve how the team tests.




- Eventually Own the test strategy for the platform: the React dashboard, the Python APIs and services, and the scanners that run against cloud accounts.

What you bring

- Experience: 3+ years in software QA, including at least 2 years writing automated tests that ran in CI.
- Python test automation: pytest fixtures, parametrization and markers, requests or httpx, and JSON schema validation.
- JavaScript or TypeScript UI automation: Playwright or Cypress (Selenium or WebdriverIO also welcome), page objects or a similar pattern, and network interception.
- React apps: you can test single-page apps with async rendering, client-side routing and cached data, and debug them in browser DevTools.
- API testing in depth: REST semantics and status codes, authentication with tokens or API keys, negative and boundary cases, and contract checks with Postman, Newman or code.
- End-to-end test design: risk-based prioritization, test data setup and teardown, isolated tests and cross-browser runs.
- CI integration: GitHub Actions, GitLab CI or Jenkins, with reports and artifacts such as traces and screenshots.
- Tooling: Docker to run test environments, Git, and SQL to check data.
- Communication: clear bug reports and test plans, and you can argue for or against a release with evidence.

Nice to have

- Security testing: the OWASP Top 10 and OWASP API Security Top 10, Burp Suite or ZAP, and authorization (IDOR) testing.
- Cloud familiarity with AWS, Azure or Google Cloud, and mocked cloud APIs with moto or LocalStack.
- Performance testing with k6, Locust or JMeter.
- Accessibility testing with axe or Lighthouse.
- Contract and property-based testing with Pact, Schemathesis or Hypothesis.
- Testing command-line tools, scanners or data pipelines.
- Visual regression testing.

📌 Quality Assurance Test Engineer (Bengaluru)
🏢 Gauntlet
📍 Bengaluru