About the role
You will be the first dedicated cloud security engineer at CapitalNow, a digital lending company regulated by the RBI. You will own the security of our AWS environment end to end: identity, secrets, network, detection and response. Your mission is to make sure that a compromise of any single server, application or credential cannot spread to the rest of our infrastructure or customer data. This is a hands-on role: you will build and fix things yourself, not only write policies. You will work closely with the Head of IT & Technology, our developers and DevOps team, and external partners such as penetration testers. Security is your primary focus, but you should be open to working as a DevOps engineer when the team needs it. That includes building and running CI/CD pipelines, deployments, monitoring and day-to-day infrastructure operations, so that security is built into how we ship rather than added later.

What you'll do
First 90 days 1. Audit our AWS accounts: IAM users, roles, policies, access keys, trust relationships, security groups and public exposure. 2. Remove long-lived credentials. Move workloads to IAM roles and all application secrets into AWS Secrets Manager, with automatic rotation. 3. Enforce IMDSv2 on all EC2 instances and apply least-privilege permissions to every instance and service role. 4. Enable and tune organization-wide CloudTrail, GuardDuty, Security Hub and AWS Config, with logs sent to a separate, locked logging account. 5. Set up alerting for high-risk events, such as IAM changes, root account use, disabled logging and unusual API activity. Ongoing
• Identity and access: run SSO with MFA for all staff, manage permission sets, and review access every quarter.
• Account structure: design and roll out a multi-account setup (AWS Organizationsf) with Service Control Policies as guardrails.
• Network security: own VPC design,



private subnets, security groups, AWS WAF, egress controls and VPN or bastion access.
• Infrastructure as code: write and review Terraform or CloudFormation so that every change to production is versioned, reviewed and repeatable.
• Data protection: manage KMS keys and encryption at rest and in transit, and set up immutable backups with AWS Backup Vault Lock.
• Detection and response: triage alerts with our managed SOC, lead the technical response to cloud incidents, and maintain incident runbooks. Vulnerability management: track and fix findings from Amazon Inspector, penetration tests and audits within agreed timelines.
• Compliance: produce evidence for RBI IT governance requirements, CERT-In directions, the DPDP Act and internal or external audits.
• Enablement: work with developers and DevOps on secure deployment practices and explain risks in plain language to management DevOps (as needed) CI/CD:
• build and maintain deployment pipelines (GitHub Actions, GitLab CI, Jenkins or AWS CodePipeline), with security checks built in.
• Deployments and releases: support application releases, rollbacks and environment management across dev, staging and production. Page 2 of 4 Cloud Security Engineer (AWS)
• Containers: package and run services with Docker on ECS or EKS. Monitoring and reliability: set up logging, metrics and alerting (CloudWatch, Prometheus, Grafana) and take part in an on-call rotation.
• Cost and capacity: right-size resources,



manage autoscaling and help keep AWS costs under control Must-have skills and experience
• 3+ years of hands-on security work in production AWS: IAM, VPC, EC2, S3, RDS, KMS, Secrets Manager, CloudTrail, GuardDuty, Security Hub and WAF.
• Strong knowledge of IAM policy design: least privilege, role assumption, permission boundaries and SCPs. Infrastructure as code with Terraform in a team that reviews changes.
• Scripting in Python or Bash to automate checks, remediation and reporting.
• Solid Linux administration and hardening skills, including web servers such as Nginx or Apache with PHP-FPM.
• Hands-on DevOps

experience:
building CI/CD pipelines, working with Docker, and setting up monitoring and alerting for production systems. Understanding of common cloud attack paths: SSRF to instance metadata, leaked access keys, over-privileged roles, public S3 buckets and exposed services.
• Hands-on experience responding to at least one real security incident, including log analysis in CloudTrail or a SIEM.
• Explicit written and spoken communication, with the ability to explain risk to non technical leaders. Willingness to take on DevOps work based on team needs. Good to have Certifications:
• AWS Certified Security – Specialty, AWS Solutions Architect, CCSP, or OSCP.
• Experience in BFSI, fintech or another regulated industry, especially with RBI, CERT-In or PCI DSS audits. Container and Kubernetes security (ECS, EKS, image scanning, runtime protection).
• CI/CD security: secrets scanning, policy-as-code (OPA, Checkov, tfsec) and pipeline hardening.
• Experience with a SIEM such as Splunk, Elastic, Microsoft Sentinel or Wazuh.
• Familiarity with cloud security posture tools such as Prowler, ScoutSuite, Wiz or Prisma Cloud.

📌 Cloud Security Engineer (Hyderabad)
🏢 CAPITAL NOW
📍 Hyderabad