About the role
We're hiring a hands-on, AI-first cloud security engineer to own infrastructure security at Zepto, building security that protects millions of users every day.
• Level: Staff (individual contributor, no people management)
•

Location:
Bangalore
•

Experience:
6+ years in security You will set the technical direction for cloud security, build the hard pieces yourself, and raise the bar for the engineers around you. We want builders, not people who buy security tools and monitor alerts. What you'll own
• Cloud security roadmap: define where Zepto's AWS, Kubernetes and AI infrastructure security needs to be, and drive it there.
• Guardrails by design: architect preventive controls across the AWS Organization, including SCPs, IAM and least privilege, account structure and baseline policies.
• CNAPP and WAF: build, tune and manage our CNAPP and web application firewall, and evolve bot mitigation and DDoS protection for high-traffic consumer workloads.
• Build, not just operate: ship automation, AI agents and tooling for posture remediation, alert triage and detection, so security scales without headcount.
• AI infrastructure security: secure the infrastructure behind Zepto's AI projects, including model and agent workloads, secrets and data access.
• Incident response: contribute to, and at times lead, cloud security investigations from first signal to root cause and fix.
• Technical leadership: review designs, mentor engineers on the team, and work with platform and engineering leaders on secure architecture.



Must-have qualifications
• 6+ years in security, including at least 3 years of hands-on AWS security at scale
• Deep knowledge of AWS IAM, SCPs, Organizations and multi-account architecture
• Production experience securing Kubernetes and containerized workloads
• Fluency with infrastructure as code (Terraform or similar)
• Has built AI agents or LLM-driven security tooling themselves, not just used AI tools
• Has led or materially contributed to cloud security incident investigations
• Can set technical direction and explain trade-offs clearly to engineering leaders Nice to have
• Rolled out or tuned a CNAPP or CSPM platform (Wiz, Upwind or similar)
• WAF, bot mitigation and DDoS experience on high-traffic consumer platforms
• Detection engineering on CloudTrail, GuardDuty or custom detections
• CI/CD and software supply chain security
• Public work: GitHub projects, talks, research, CVEs or blogs What success looks like in year one
• A explicit cloud security roadmap, agreed with leadership and on track
• Preventive guardrails enforced across the AWS Organization, with exceptions tracked
• CNAPP fully rolled out and tuned, with findings routed and remediated, not just reported
• Multiple Security automations or AI agents in production that measurably cut manual work
• AI project infrastructure covered by baseline security controls
• Cloud incidents investigated faster, with lessons fed back into guardrails and detections

📌 Staff Security Engineer (India)
🏢 Zepto
📍 India