Write the policy gates in the delivery pipeline (OPA / Conftest, Kyverno or equivalent): network exposure, IAM, image provenance, secrets, data residency
Own secrets and workload identity: Vault or cloud-native equivalents, rotation, short-lived and scoped credentials, no long-lived keys
Build detection and response: runtime security (Falco / Tetragon or equivalent), log-based detections, alerting and playbooks
Run the finding-to-fix loop for security findings: triage, assign, fix, add a detection, retest
Use LLMs and AI agents in security work: triaging findings, reviewing infrastructure changes, tuning detections, drafting incident timelines — and secure the agents themselves with scoped, short-lived permissions and audit trails
Harden the supply chain: image signing and scanning, dependency policy, SBOMs
Automate compliance evidence (CERT-In, ISO 27001, SOC 2, DPDP) together with the compliance team
Set the security standards other engineers follow and review security-relevant changes
Take part in on-call and lead security incidents
Requirements
5–9 years in DevOps, platform or security engineering, with at least 2 in a bank, fintech, payments company or other regulated environment
Strong Kubernetes and Linux fundamentals; has run production clusters on at least one major cloud
Hands-on with Terraform / OpenTofu and GitOps (ArgoCD or Flux)
Has built security automation, not only operated tools: policy-as-code, secrets rotation, CI/CD security gates or detection pipelines
Working knowledge of IAM, network security, TLS and secrets management across clouds
Scripting and tooling in Python or Go
Has been through security audits and knows what evidence auditors need
Has built or used AI-based automation in infrastructure or security work, and understands the risks of AI agents: prompt injection, over-broad permissions, unreviewed actions
Nice to have: Vault, SPIFFE / SPIRE, Falco or Tetragon, Cloudflare WAF, incident response lead experience, multi-cloud experience
