Key responsibilities

Cloud security (AWS and GCP)

- Design, implement and continuously audit security baselines across AWS accounts and GCP projects: IAM, networking, encryption, logging and organization-level policies.
- Run cloud security posture management and close misconfigurations before they reach production.
- Enforce least-privilege access, short-lived credentials, workload identity and strong secrets management.

DevSecOps and pipeline security

- Build security into CI/CD: SAST, SCA, secret scanning, container and IaC scanning, and artifact signing, with clear pass/fail gates.
- Secure infrastructure-as-code (Terraform, CloudFormation) using policy-as-code and review standards.
- Harden Kubernetes and container workloads (EKS, GKE), images and registries.

Detection, response and resilience

- Own cloud logging, monitoring and alerting: CloudTrail, GuardDuty, Security Hub, Cloud Audit Logs and Security Command Center, feeding a central SIEM.
- Lead technical triage and containment for security incidents, run post-incident reviews and drive remediation to closure.
- Maintain and test incident response runbooks and recovery procedures.

Vulnerability and risk management

- Run vulnerability management across infrastructure, dependencies and images, with severity-based SLAs and tracked remediation.
- Perform threat modelling and security reviews on new services and architecture changes.
- Coordinate penetration tests and act on their findings.

Governance and enablement

- Support compliance and audit readiness (SOC 2, ISO 27001, PCI DSS and applicable data-protection requirements) with automated evidence collection.
- Document standards, coach engineers on secure practices and be the go-to security partner for product and platform teams.

Required qualifications





- 8+ years in security engineering, DevSecOps, SRE or cloud infrastructure, with at least 4 years focused on cloud security.
- Hands-on, production-level depth in both AWS and Google Cloud security: IAM design, VPC/network segmentation, KMS, logging, organization-level guardrails (AWS Organizations and SCPs; GCP Organization Policy).
- Strong infrastructure-as-code skills with Terraform (CloudFormation or Pulumi a plus), including policy-as-code (OPA, Sentinel, Checkov or similar).
- Proven experience building and securing CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins or Cloud Build) with integrated security scanning.
- Hands-on experience with security tooling in at least four of these areas: CSPM, SAST/DAST, SCA, secret scanning, container scanning, SIEM, EDR and vulnerability scanning.
- Practical Kubernetes and container security experience (EKS and/or GKE).
- Real incident response experience: triage, containment, forensics on cloud workloads, root cause analysis and written post-incident reports.
- Proficiency in Python, Go or Bash for automation and tooling.
- Solid grasp of application and infrastructure security fundamentals: OWASP Top 10, threat modelling, zero trust, encryption and key management.
- Explicit written and verbal communication, including the ability to brief both engineers and leadership.

Preferred qualifications

- Certifications: AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, CISSP, CCSP, OSCP, CKS or GCSA.
- Experience in a regulated environment such as fintech or payments, including PCI DSS or SOC 2 audits.
- Experience with SOAR, security data lakes or detection-as-code.
- Experience with cloud forensics, DFIR tooling and tabletop exercises.
- Contributions to security tooling, open-source projects or published research.

📌 Sr. DevSecOps Engineer (Contractual) (Bengaluru)
🏢 Borderless
📍 Bengaluru