LW3 is hiring its first dedicated DevSecOps Engineer to own the AWS platform that runs our Digital Product Passport (DPP) service in production, and to make it audit-ready for ISO/IEC 27001:2022 before our first enterprise clients go live.

Title

DevSecOps Engineer

Company

LW3 Pvt Ltd

Location

Hybrid

Type

Full time

Reports to

CTO

Experience

2+ years in DevOps, SRE or cloud security

About LW3

LW3 builds Digital Product Passports: verifiable, machine-readable records of where a product came from, what it is made of and how it should be recycled. Our first market is EV and industrial batteries under EU Battery Regulation 2023/1542, with textiles, clothing, handloom, handicraft and green hydrogen on the same platform.

Each passport is anchored on the Algorand blockchain and published through a public, standards-based API (CEN-CENELEC EN 18216–18223). Clients are battery makers and OEMs who must hand regulators and buyers data they can trust, so security and uptime are part of the product, not overhead.

What you'll own

The whole platform is code in one infra repo, and you will be its primary owner.

Area

What runs today

Cloud

AWS multi-account

Compute

Amazon EKS on Graviton (ARM64), Karpenter autoscaling, ALB

Edge

CloudFront + CloudFront SaaS Manager for per-client custom domains, AWS WAF

Data

MongoDB Atlas over PrivateLink, Aurora PostgreSQL (pgvector), ElastiCache Redis, S3, all KMS-encrypted

Identity

Self-hosted Zitadel v4 (OIDC) on EKS, configured with Terraform

Delivery

GitHub Actions with OIDC → ECR → Argo CD GitOps, Argo Rollouts canary, Kustomize + Helm

Supply chain

cosign-signed images, SBOMs, Trivy, gitleaks, Checkov, Kyverno admission policies

Secrets

AWS Secrets Manager + External Secrets Operator

Observability

OpenTelemetry → AWS X-Ray + Managed Prometheus, Grafana

Security posture

GuardDuty, Security Hub (FSBP + CIS 3.0), AWS Config

Application

Node.js / TypeScript (Express 5) API and worker, React SPA, Algorand signing keys

What you'll do

Platform and reliability

- Run and evolve the EKS clusters, Karpenter, networking and Terraform modules across staging and production.
- Build and test disaster recovery: a warm standby in ap-south-2 (Hyderabad) and a tertiary standby in eu-central-1 (Frankfurt), with restore drills against stated RPO/RTO.




- Keep cost inside budget while capacity grows from one client to many.
- Be on call for production, lead incidents and write blameless postmortems.

Security engineering

- Own cloud security posture: IAM least privilege, KMS, network segmentation, WAF rules, GuardDuty and Security Hub findings.
- Harden Kubernetes: pod security, Kyverno policies, image provenance, runtime threat detection.
- Manage secrets and key rotation, including the Algorand mainnet signing keys.
- Run vulnerability management end to end: scanning, triage, patch SLAs, and coordination of external penetration tests.
- Harden and operate the self-hosted Zitadel identity provider.

Secure delivery

- Maintain the GitHub Actions → Argo CD pipeline: signed builds, SBOMs, policy gates, canary analysis and fast rollback.
- Put SAST, dependency and IaC scanning in front of every merge, tuned so developers trust the signal.
- Act as second release approver, so production changes meet segregation of duties.

Compliance and governance

- Drive ISO/IEC 27001:2022 readiness: map Annex A controls to evidence, deploy the AWS Config conformance pack, keep the risk register and policies current.
- Answer client security questionnaires and support audits.
- Keep data handling aligned with GDPR and India's DPDP Act, including EU data residency when we add an EU cell.

Your first 90 days

- Days 1–30: Get production access, read the deployment pack and ISMS policies, and ship a change through the full pipeline. Become the second release approver and turn on required reviews for production.
- Days 31–60: Close the open items on our security gap list: deploy the ISO 27001 conformance pack, tighten identity sign-up, and rotate the mainnet signing key ahead of the blockchain launch.
- Days 61–90: Stand up the ap-south-2 DR standby and run the first full restore drill. Set alerting SLOs and an on-call rota, and produce an ISO 27001 readiness report for the CTO.

What you bring

- 4+ years running production workloads on AWS,



at least 2 of them on Kubernetes (EKS preferred).
- Strong Terraform: you write modules, manage state across accounts and review plans before you apply.
- Hands-on GitOps and CI/CD with GitHub Actions and Argo CD (or Flux).
- Solid AWS security: IAM policy design, KMS, VPC design, WAF, GuardDuty, Security Hub.
- Container and supply-chain security: image scanning, signing (cosign/Sigstore), SBOMs, admission policies.
- Observability with Prometheus, Grafana and OpenTelemetry or similar.
- Scripting in Bash plus one of Python, Go or TypeScript.
- You have handled real incidents and can explain what you changed afterwards.
- Clear written English: you document decisions, runbooks and risk acceptances.

Nice to have

- You have taken a company through ISO 27001 or SOC 2 certification.
- Certifications such as AWS Security Specialty, CKA/CKS, or CISSP.
- Experience running an OIDC identity provider (Zitadel, Keycloak, Auth0).
- MongoDB Atlas or Aurora operations, backups and cross-region DR.
- Blockchain key management, HSMs or custody of signing keys.
- Multi-tenant SaaS with per-client custom domains and TLS.
- Familiarity with GDPR, India's DPDP Act or EU product regulation.

What we offer

- Ownership of a production platform from day one, with a direct line to the CTO.
- Work on regulated, real-world infrastructure: EU battery compliance and public blockchain.
- Budget for certifications and conferences.
- Compensation: open question, to be set before posting (salary band + ESOP).

Hiring process

- 30-minute intro call with the CTO.
- Technical deep dive (60 min): walk us through a platform you ran and an incident you handled.
- Practical exercise (90 min, live): review a Terraform + Kubernetes change and threat-model a small service.
- Team and culture conversation.
- Offer.

To apply, send your CV and a short note on the most interesting security problem you have fixed to [email protected] .

Pay: ₹300,000.00 - ₹1,050,000.00 per year

Benefits:

- Flexible schedule
- Work from home

Ability to commute/relocate:

- Guwahati, Assam: Reliably commute or willing to relocate with an employer-provided relocation package (Required)

Education:

- Bachelor's (Required)

Experience:

- DevOps: 2 years (Required)

Work Location: Hybrid remote in Guwahati, Assam

📌 Senior DevSecOps Engineer (Guwahati)
🏢 LW3 Private
📍 Guwahati