Location: Bengaluru

Experience: 1–2 years

About LH2 AI Labs

LH2 AI Labs builds post-training infrastructure for frontier AI models. Our mission is to bring data that has never been used for training (the code, conversations, documents and workflows inside real institutions) into frontier AI pipelines, safely and with the trust of the people who own it. We work across verticals such as coding, computer use, agentic workflows, medical and audio, alongside a network of vetted domain experts. We’re a small team in Bengaluru, founded by second-time founders.

About the role

Our business depends on two groups trusting us with things they protect closely. Companies trust us with their internal code and data. Frontier labs trust that what we deliver is clean, has rights cleared, and won’t come back to hurt them. Every promise we make to either side is a security claim, and we want each one to be true and provable.

You’ll be one of our first security engineers, working on our cloud infrastructure, our build pipelines, and the systems that track every dataset moving through us. We want someone who writes code to solve security problems instead of only configuring products, and who wants to grow fast in a high-ownership setting.

Responsibilities

- Help design and maintain our cloud account and network structure: separate environments, segmentation, and no long-lived credentials.
- Manage infrastructure as code with security review built in, and keep secrets and encryption keys in managed systems.
- Centralise logs from cloud, identity, endpoints and applications, and build alerts and detections on top of them.
- Harden CI/CD, containers and build pipelines, and add security checks (SAST, dependency and secret scanning) where engineers already work.




- Contribute to LH2’s threat model, covering insiders, our expert network, customer environments and the buyers we deliver to.
- Help secure the redaction kit and other software that runs in data owners’ environments, including build signing and updates.
- Build chain-of-custody tracking for codebases and datasets, from intake to delivery and withdrawal.
- Automate evidence collection for SOC 2, DPDP and lab security reviews.
- Take part in incident response and customer security reviews.

You may be a good fit if you

- Have 1–2 years of experience in security engineering, DevSecOps, cloud or infrastructure engineering.
- Have working knowledge of AWS or GCP, covering IAM, networking and core services.
- Are comfortable with containers (Docker, Kubernetes basics) and CI/CD tools (GitHub Actions, GitLab CI or similar).
- Write code in Python, Go or a similar language to automate work.
- Understand common vulnerabilities (OWASP Top 10, cloud misconfigurations) and can explain them to the engineers who wrote them.
- Are curious about how systems break and want to learn how to defend them.

Nice to have

- Experience with Terraform or another infrastructure-as-code tool.
- Exposure to SIEM or log platforms and writing detections.
- CTF, bug bounty or offensive security experience.
- Familiarity with SOC 2, ISO 27001 or DPDP.

Representative projects

- Restructure our cloud so production data sits in its own accounts, reachable only through time-bound, approved access.
- Threat-model the redaction kit so a data owner can approve it: signed builds, no outbound paths except the ones they allow.
- Fingerprint every delivery so that a dataset leaked from any lab buyer can be traced back to its delivery.
- Automate SOC 2 evidence collection so the audit is a byproduct of how we operate.

📌 DevSecOps Engineer (Bengaluru)
🏢 LH2 AI Labs
📍 Bengaluru