About the role:

You will be the first dedicated cloud security engineer at CapitalNow, a digital lending company regulated by the RBI. You will own the security of our AWS environment end to end: identity, secrets, network, detection and response. Your mission is to make sure that a compromise of any single server, application or credential cannot spread to the rest of our infrastructure or customer data. This is a hands-on role: you will build and fix things yourself, not only write policies.

You will work closely with the Head of IT & Technology, our developers and DevOps team, and external partners such as penetration testers. Security is your primary focus, but you should be open to working as a DevOps engineer when the team needs it. That includes building and running CI/CD pipelines, deployments, monitoring and day-to-day infrastructure operations, so that security is built into how we ship rather than added later.

What you'll do :

First 90 days 1.

Audit our AWS accounts: IAM users, roles, policies, access keys, trust relationships, security groups and public exposure.

- Remove long-lived credentials. Move workloads to IAM roles and all application secrets into AWS Secrets Manager, with automatic rotation.
- Enforce IMDSv2 on all EC2 instances and apply least-privilege permissions to every instance and service role.
- Enable and tune organization-wide CloudTrail, GuardDuty, Security Hub and AWS Config, with logs sent to a separate, locked logging account.
- Set up alerting for high-risk events, such as IAM changes, root account use, disabled logging and unusual API activity.

Ongoing

- Identity and access: run SSO with MFA for all staff, manage permission sets, and review access every quarter.
- Account structure: design and roll out a multi-account setup (AWS Organizationsf) with Service Control Policies as guardrails.
- Network security:



own VPC design, private subnets, security groups, AWS WAF, egress controls and VPN or bastion access.
- Infrastructure as code: write and review Terraform or CloudFormation so that every change to production is versioned, reviewed and repeatable.
- Data protection: manage KMS keys and encryption at rest and in transit, and set up immutable backups with AWS Backup Vault Lock.
- Detection and response: triage alerts with our managed SOC, lead the technical response to cloud incidents, and maintain incident runbooks. Vulnerability management: track and fix findings from Amazon Inspector, penetration tests and audits within agreed timelines.
- Compliance: produce evidence for RBI IT governance requirements, CERT-In directions, the DPDP Act and internal or external audits.
- Enablement: work with developers and DevOps on secure deployment practices and explain risks in plain language to management

DevOps (as needed) CI/CD:

- build and maintain deployment pipelines (GitHub Actions, GitLab CI, Jenkins or AWS CodePipeline), with security checks built in.
- Deployments and releases: support application releases, rollbacks and environment management across dev, staging and production. Page 2 of 4 Cloud Security Engineer (AWS)
- Containers: package and run services with Docker on ECS or EKS. Monitoring and reliability: set up logging, metrics and alerting (CloudWatch, Prometheus, Grafana) and take part in an on-call rotation.
- Cost and capacity:



right-size resources, manage autoscaling and help keep AWS costs under control

Must-have skills and experience

- 3+ years of hands-on security work in production AWS: IAM, VPC, EC2, S3, RDS, KMS, Secrets Manager, CloudTrail, GuardDuty, Security Hub and WAF.
- Strong knowledge of IAM policy design: least privilege, role assumption, permission boundaries and SCPs. Infrastructure as code with Terraform in a team that reviews changes.
- Scripting in Python or Bash to automate checks, remediation and reporting.
- Solid Linux administration and hardening skills, including web servers such as Nginx or Apache with PHP-FPM.
- Hands-on DevOps experience: building CI/CD pipelines, working with Docker, and setting up monitoring and alerting for production systems. Understanding of common cloud attack paths: SSRF to instance metadata, leaked access keys, over-privileged roles, public S3 buckets and exposed services.
- Hands-on experience responding to at least one real security incident, including log analysis in CloudTrail or a SIEM.
- Clear written and spoken communication, with the ability to explain risk to non technical leaders. Willingness to take on DevOps work based on team needs.

Valuable to have Certifications:

- AWS Certified Security – Specialty, AWS Solutions Architect, CCSP, or OSCP.
- Experience in BFSI, fintech or another regulated industry, especially with RBI, CERT-In or PCI DSS audits. Container and Kubernetes security (ECS, EKS, image scanning, runtime protection).
- CI/CD security: secrets scanning, policy-as-code (OPA, Checkov, tfsec) and pipeline hardening.
- Experience with a SIEM such as Splunk, Elastic, Microsoft Sentinel or Wazuh.
- Familiarity with cloud security posture tools such as Prowler, ScoutSuite, Wiz or Prisma Cloud.

📌 Cloud Security Engineer (AWS) (Hyderabad)
🏢 CAPITAL NOW
📍 Hyderabad