Senior Cybersecurity Specialist at Fonada · Noida · 7 - 10 years · ₹15L - ₹20L / yr · Profitable · Posted 27 May 2026
PythonAbout the Role
We are seeking an experienced Cyber Security Specialist who can operate across both offensive and defensive security disciplines. This dual-role professional will lead Vulnerability Assessment and Penetration Testing (VAPT) engagements, act as the in-house Red Team to simulate real-world adversaries, and own the implementation and continuous improvement of the Information Security Management System (ISMS) aligned with ISO/IEC 27001 and related standards. You will combine hands-on offensive security work with governance, audit readiness, and stakeholder engagement across engineering, IT, legal, and executive leadership.
Key Responsibilities
VAPT & Red Team Operations
- Plan, scope, and execute end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements across web applications, mobile apps, APIs, networks, cloud environments, wireless, and physical infrastructure.
- Act as the organization's in-house Red Team, simulating advanced persistent threat (APT) actors through adversary emulation, social engineering, phishing campaigns, and physical intrusion testing where authorized.
- Design and execute Red Team operations aligned with MITRE ATT&CK, TIBER-EU, and similar frameworks; develop custom Tactics, Techniques, and Procedures (TTPs).
- Conduct manual and automated exploitation, post-exploitation, lateral movement, privilege escalation, and persistence testing in production-like environments.
- Develop custom exploits, payloads, scripts, and tooling (Python, PowerShell, Bash, C/C++, Go) to bypass security controls during sanctioned engagements.
- Perform source code reviews, threat modeling, and secure architecture reviews of new and existing systems.
- Coordinate Purple Team exercises with the Blue Team / SOC to validate detection coverage and improve defensive playbooks.
- Produce high-quality VAPT and Red Team reports with executive summaries, technical findings, proof-of-concept exploits, risk ratings (CVSS), and prioritized remediation guidance.
- Re-test remediated findings and track closure with engineering and IT teams through to verification.
ISO Compliance & Governance
- Lead the implementation, maintenance, and continual improvement of the ISMS in line with ISO/IEC 27001:2022, including scope definition, Statement of Applicability (SoA), and risk treatment plans.
- Own and maintain ISO policies, procedures, controls, and documentation across the organization, ensuring alignment with ISO 27001, ISO 27017, ISO 27018, and ISO 22301.
- Plan and coordinate internal and external audits; serve as the primary liaison with certification bodies, auditors, and regulators.
- Conduct risk assessments, business impact analyses (BIA), and threat modeling; maintain a central risk register and drive remediation.
- Map VAPT and Red Team findings to ISO 27001 Annex A controls and feed results into the risk management lifecycle.
- Support compliance with adjacent frameworks: SOC 2, NIST CSF, GDPR, HIPAA, PCI-DSS, and DPDP Act (India), as applicable.
- Define and report security and compliance KPIs/KRIs to senior leadership; prepare materials for management reviews and board updates.
- Develop and deliver security awareness training, phishing simulations, and role-based secure-coding training.
- Drive third-party / vendor risk management, including security questionnaires, contractual clauses, and ongoing monitoring.
- Partner with engineering and DevOps to embed security into the SDLC, CI/CD pipelines, and cloud architectures (DevSecOps).
Incident Response & Continuous Improvement
- Support incident response activities: detection, triage, containment, eradication, recovery, and post-incident reviews.
- Maintain business continuity and disaster recovery plans; coordinate BCP/DR testing and tabletop exercises.
- Stay current on emerging threats, CVEs, attacker techniques, regulatory changes, and ISO standard updates; recommend and drive improvements.
Required Qualifications
- 8+ years of progressive experience in cyber security, with at least 4 years in hands-on offensive security (VAPT, penetration testing, or Red Team) and 3+ years in ISO 27001 implementation and audits.
- Proven track record of leading VAPT engagements across web, mobile, API, network, cloud (AWS / Azure / GCP), and wireless environments.
- Hands-on experience executing Red Team operations and adversary emulation aligned with MITRE ATT&CK.
- Deep proficiency with offensive security tooling: Burp Suite Pro, Metasploit, Cobalt Strike (or open-source equivalents like Sliver, Mythic, Havoc), Nmap, Nessus, Nuclei, BloodHound, Impacket, Responder, and OWASP ZAP.
- Strong scripting and exploit development skills in Python, PowerShell, Bash, and at least one compiled language (C/C++, Go, or Rust).
- Proven hands-on experience leading an organization through ISO 27001 certification and surveillance audits end-to-end.
- Strong working knowledge of ISO/IEC 27001:2022 (including Annex A controls), ISO 27002, ISO 27017, ISO 27018, and ISO 22301.
- Solid understanding of security domains: IAM, network security, endpoint security, cloud security, application security (OWASP Top 10, API Security Top 10), and Active Directory attack paths.
- Experience with risk assessment methodologies (ISO 27005, NIST 800-30) and the ability to translate offensive findings into business risk.
- Strong report-writing, policy-drafting, and executive communication skills.
- Bachelor's degree in Computer Science, Information Security, Engineering, or a related field (or equivalent experience).
Preferred Qualifications
- Offensive security certifications: OSCP, OSEP, OSWE, OSED, CRTO, CRTP, CRTE, CRTL, GPEN, GXPN, GWAPT, or CEH Practical.
- Governance certifications: ISO 27001 Lead Implementer and/or Lead Auditor, CISSP, CISM, CISA, or CRISC.
- Cloud security certifications (CCSP, AWS Security Specialty, Azure Security Engineer, or GCP Professional Cloud Security Engineer).
- Published CVEs, security research, bug bounty achievements, or contributions to open-source security tools.
- Experience with Active Directory / Entra ID red teaming, Kerberos attacks, and modern EDR/XDR evasion techniques.
- Experience with container, Kubernetes, and serverless security testing.
- Experience implementing or auditing additional frameworks: SOC 2 Type II, NIST CSF, NIST 800-53, HITRUST, or PCI-DSS.
- Experience with GRC platforms (Vanta, Drata, Sprinto, ServiceNow GRC, Archer, OneTrust).
- Experience in regulated industries: financial services, healthcare, SaaS, or critical infrastructure.
- Experience briefing executive leadership, customers, and external auditors on offensive findings and remediation strategy.
Shubham Vishwakarma
Full Stack Developer - Averlon
About Fonada
About
Company social profiles
Similar jobs (10)
A BIT ABOUT US
Appknox is one of the top Mobile Application security companies recognized by Gartner and G2. A profitable B2B SaaS startup headquartered in Singapore & working from Bengaluru.
The primary goal of Appknox is to help businesses and mobile developers secure their mobile applications with a focus on delivery speed and high-quality security audits.
Appknox has helped secure mobile apps at Fortune 500 companies with major brands spread across regions like India, South-East Asia, Middle-East, US, and expanding rapidly. We have secured 300+ Enterprises globally.
We are a 65+ incredibly passionate team working to make an impact and helping some of the biggest companies globally. We work in a highly collaborative, very fast-paced work environment. If you have what it takes to be part of the team, we are excited and let’s speak further.
The Opportunity
To join the security team engaging with multiple clients, helping them with end to end security audits, also research about new topics and vulnerabilities to be added to the scanner, present it in conferences.
What An Ideal Candidate Would Look Like:
- Skills - Application Penetration Testing (Web, iOS and Android), experience with IoT testing, source code audits.
- Technology Stack: AWS, GCP, Objective C, Java, Python
- Responsibilities: Engage with clients for scoping call, perform security audits, remediation call with clients to patch the issues, research on new technologies/vulnerabilities
Minimum Requirements
- 2-4+ years of experience in application security and vulnerability research
- Strong foundation in mobile app security - Android or Ios
- Proven track record of discovering and disclosing CVEs in mobile platforms or popular applications (provide - github/bug bounty profiles)
- Strong understanding of exploit mitigations and proven ability to bypass them
- Should be able to architect automated detection logic for new vulnerabilities and integrate them into our security products
- Develop AI-driven agents to automate dynamic analysis
- Should be able to Leverage AI/LLMs to augment Pentesting efforts
- Ability to work independently in a fast-paced environment, balancing deep research with practical deliverables
Good to have Requirements
- Understanding of AI/ML security risks
Responsibilities
- Security assessment of web/mobile applications on various platforms
- Focusing on Mobile Application Security Research for new vulnerabilities
- Static and Dynamic Code Analysis
- Develop and interpret security standards and guides
- Automation of exploit development
- Understand and explain the results with impact on business and compliance status
- Continuously learning and training on latest tools and technique
Work Expectations
Within 1 month
Training on processes, security workflows and develop understanding on internal tools.
Within 3 months
Actively contributing in exploit development and automation of it with the team.
Within 6 months
Expected to achieve Subject Matter Expert status on our core security products. We expect you to validate your findings against real-world conditions, with a strong emphasis on translating internal discoveries into actionable bug bounty submissions and earned CVEs to benchmark your impact against the external security community.
Within 1 Year
By the end of your first year, you will be expected to produce and submit a piece of novel, peer-reviewed security research. This deliverable must be of a quality suitable for top-tier industry conferences.
Personality traits we really admire
- A confident and dynamic working persona, which can bring fun to the team, and a sense of humour, is an added advantage.
- Great attitude to ask questions, learn and suggest process improvements.
- Has attention to details and helps identify edge cases.
- Highly motivated and coming up with fresh ideas and perspectives to help us move towards our goals faster.
- Follow timelines and absolute commitment to deadlines.
Interview Process - would be team specific
- Round 1- CTF round
- Round 2 -Profile Evaluation; HR
- Round 3 -Technical Interview with security team members
- Round 4 -Technical Interview with the Hiring Manager
- Round 5 -Technical round with CTO
- Round 6 -HR Round
Compensation
- As per Industry Standards
Why Join Us
- Freedom & Responsibility: If you are a person who enjoys challenging work & pushing your boundaries, then this is the right place for you. We appreciate new ideas & ownership as well as flexibility with working hours.
- Great Salary & Equity: We keep up with the market standards & provide pay packages considering updated standards. Also as Appknox continues to grow, you’ll have a great opportunity to earn more & grow with us. Moreover, we also provide equity options for our top performers.
- Holistic Growth: We foster a culture of continuous learning and take a much more holistic approach to train and develop our assets: the employees. We shall also support you all on that journey of yours.
- Transparency: Being a part of a start-up is an amazing experience, one of the reasons being open communication & transparency at multiple levels. Working with Appknox will give you the opportunity to experience it all first-hand.
Python
JavaCybersecurity Engineer – AI Training Project
About the Opportunity
We’re looking for experienced Cybersecurity Engineers to contribute technical expertise to a customer project focused on improving the capabilities of next-generation AI systems.
In this role, you’ll use your real-world experience in cybersecurity, software engineering, vulnerability assessment, and secure development to create high-quality technical inputs that help AI systems better understand, debug, secure, and reason about complex software.
What You’ll Do
- Analyze, debug, and resolve software bugs, vulnerabilities, and security issues across complex codebases.
- Review source code and identify potential security weaknesses, vulnerabilities, and attack vectors.
- Perform security assessments, vulnerability assessments, penetration testing, and codebase audits.
- Develop and modify software using languages such as Python, Java, Rust, Go, C++, or TypeScript.
- Implement new features and fix existing functionality while maintaining strong security and engineering standards.
- Refactor legacy code to improve security, maintainability, reliability, and performance.
- Work on backend systems and help optimize applications for scalability, performance, and security.
- Analyze real-world security scenarios and translate your expertise into high-quality technical examples and problem-solving tasks.
- Document technical findings, vulnerabilities, debugging approaches, and recommended solutions.
- Provide domain expertise that helps improve how AI systems reason about software engineering and cybersecurity problems.
What We’re Looking For
- Strong professional experience in Cybersecurity / Application Security / Product Security / DevSecOps / Penetration Testing / Vulnerability Management.
- Strong programming experience in one or more of:
- Python
- Java
- Rust
- Go
- C++
- TypeScript
- Proven experience with debugging, troubleshooting, and fixing complex software issues.
- Hands-on experience with penetration testing, vulnerability assessment, security auditing, or application security.
- Understanding of secure software development practices and modern security threats.
- Strong knowledge of data structures, algorithms, software architecture, and code quality.
- Ability to review unfamiliar codebases and quickly understand how systems work.
- Strong written communication and the ability to explain complex technical findings clearly.
Nice to Have
- Experience with OWASP, API security, cloud security, DevSecOps, or threat modeling.
- Experience performing security assessments on production applications or enterprise systems.
- Experience with tools such as Burp Suite, Metasploit, Nmap, Wireshark, SAST/DAST tools, or vulnerability scanners.
- Contributions to open-source security or software projects.
- Experience working with AI/ML systems, LLMs, data annotation, or AI training projects.
- Relevant security certifications such as OSCP, OSWE, CEH, CISSP, Security+, or equivalent practical experience.
Engagement
- Role: Cybersecurity Engineer
- Work: Remote(Contract)
- Experience: Mid-level to Senior
- Programming: Required
- Cybersecurity expertise: Required
Why Join?
This is an opportunity to apply your existing cybersecurity expertise to an emerging area of technology. Your practical experience debugging software, identifying vulnerabilities, securing applications, and solving complex engineering problems will directly contribute to improving the capabilities of next-generation AI systems.
If you enjoy breaking down complex technical problems, finding vulnerabilities, fixing software, and thinking deeply about how systems work, this project could be a strong fit.
📢 We're Hiring | Cybersecurity Consultant | Gurugram
Role: Cybersecurity Consultant
Experience: 7+ Years
Location: Gurugram, Haryana
We are looking for experienced cybersecurity professionals with strong hands-on expertise in security operations, infrastructure security, vulnerability management and incident response.
🔹 Key Responsibilities
- Manage and strengthen security controls across enterprise IT infrastructure.
- Perform vulnerability assessments, remediation tracking and patch management.
- Monitor security alerts, investigate incidents and support threat hunting.
- Implement and manage SIEM, EDR and endpoint security solutions.
- Work on IAM controls, including MFA, SSO, RBAC and privileged access management.
- Support network security, including firewalls, IDS/IPS, segmentation and secure remote access.
- Assist with backup, recovery, disaster recovery and business continuity activities.
- Maintain security documentation, remediation evidence and audit compliance.
🔹 Required Skills
- 7+ years of relevant experience in cybersecurity, security engineering or security operations.
- Hands-on experience with SIEM tools such as Microsoft Sentinel, Splunk, QRadar or ArcSight.
- Knowledge of Microsoft security technologies, including Defender and Entra ID, is preferred.
- Experience with vulnerability management tools such as Tenable, Qualys or CrowdStrike Falcon.
- Strong understanding of incident response, threat hunting, network security and security remediation.
- Experience with EDR, IAM and enterprise security controls.
⭐ Preferred: OT/ICS security, IEC 62443, NIST frameworks, backup/DR and network segmentation experience.
📩 Interested candidates: Please share your updated cv at: snigdhaattheratebeanhr.com
Cyber Security Expert
We are seeking a highly skilled Cyber Security Expert with strong expertise in AI-driven
security tools and ethical hacking techniques. The ideal candidate will safeguard our digital
infrastructure, proactively identify vulnerabilities, and design intelligent defense mechanisms
against evolving cyber threats.
Key Responsibilities
• Threat Analysis: Identify, assess, and mitigate potential risks across systems and
networks.
• AI Security Tools: Deploy and manage AI-based solutions for intrusion detection,
anomaly monitoring, and predictive threat modelling.
• Ethical Hacking: Conduct penetration testing, simulate cyber-attacks, and recommend
remediation strategies.
• Incident Response: Lead investigations, contain breaches, and implement recovery
measures.
• Compliance & Governance: Ensure adherence to data protection laws, industry
standards, and organizational policies.
• Training & Awareness: Educate employees on best practices and emerging threats.
Required Skills & Qualifications
• Proven hands-on experience with AI-powered security platforms (e.g., SIEM, SOAR,
ML-based anomaly detection).
• Strong knowledge of ethical hacking tools (Metasploit, Burp Suite, Kali Linux, etc.).
• Expertise in network security, firewalls, IDS/IPS, and endpoint protection.
• Familiarity with cloud security (AWS, cloud platform).
• Proficiency in scripting languages (Python, Bash, PowerShell) for automation.
• Solid understanding of cryptography, authentication protocols, and secure coding
practices.
Position: Manager – Information Security
Experience: 8+ years (with minimum 3 years in leadership roles)
Location: Gurgaon
Qualification: Bachelors in IT/Computer Science; Preferred: MBA, CISSP, CISM, CISA, ISO 27001/27701 Lead Auditor and Lead Implementor
Key Responsibilities:
? Lead the design, implementation, and continuous improvement of the enterprise-wide ISMS and PIMS programs.
? Develop and manage the InfoSec strategy aligned with business goals and regulatory requirements (ISO 27001:2022, ISO 27701:2019, DPDPA, IT Act, CERT-In).
? Oversee security risk assessments, audits, and remediation plans across IT and business units.
? Manage a team of security professionals; mentor, coach, and evaluate performance.
? Collaborate with Legal, Compliance, IT, and Business stakeholders to ensure security by design.
? Lead incident response, RCA, and post-mortem reviews.
? Drive security awareness and training programs across the organization.
? Manage security budgets, vendor relationships, and contract negotiations.
Technical Skills:
? Strong knowledge of IBM QRadar SIEM, GTB DLP, CyberArk PAM, Wiz CNAPP, Sentinel One EDR, Qualys VA and other PT tools.
? Experience in cloud security governance (Preferred on AWS and Azure; Good to have GCP).
? Experience of MITRE ATT&CK, NIST CSF, CIS Controls, OWASP Top 10.
mail updated resume with salary details-
email: etalenthire[at]gmail[dot]com
satish: 88O 27 49 743
website: www.glansolutions.com
Position: Manager – Information Security
Experience: 10+ years
Location: Gurgaon
Qualification: Bachelors in IT/Computer Science; Preferred: MBA, CISSP, CISM, CISA, ISO 27001/27701 Lead Auditor and Lead Implementor
Key Responsibilities:
- Lead the design, implementation, and continuous improvement of the enterprise-wide ISMS and PIMS programs.
- Develop and manage the InfoSec strategy aligned with business goals and regulatory requirements (ISO 27001:2022, ISO 27701:2019, DPDPA, IT Act, CERT-In).
- Oversee security risk assessments, audits, and remediation plans across IT and business units.
- Manage a team of security professionals; mentor, coach, and evaluate performance.
- Collaborate with Legal, Compliance, IT, and Business stakeholders to ensure security by design.
- Lead incident response, RCA, and post-mortem reviews.
- Drive security awareness and training programs across the organization.
- Manage security budgets, vendor relationships, and contract negotiations.
Technical Skills:
- Strong knowledge of IBM QRadar SIEM, GTB DLP, CyberArk PAM, Wiz CNAPP, Sentinel One EDR, Qualys VA and other PT tools.
- Experience in cloud security governance (Preferred on AWS and Azure; Good to have GCP).
- Experience of MITRE ATT&CK, NIST CSF, CIS Controls, OWASP Top 10.
mail updated resume with salary details-
email: etalenthire[at]gmail[dot]com
satish: 88 O2 74 97 43
About the role
EOR SOFTWARE LTD is a UK-registered software development company.
We are looking for a Cybersecurity Technical Specialist based in India who can quickly study unfamiliar products, prepare for technical discussions, and participate in live calls with software vendors in English.
Responsibilities
• Study vendors’ products and the prepared documentation before each call.
• Quickly understand the product’s purpose, architecture, deployment, integrations, licensing, and limitations.
• Collect missing information from the internal technical team using a short checklist.
• Participate in vendor calls in English and present the agreed use case.
• Ask clarifying questions and document requirements, limitations, and next steps.
• Never guess or invent technical information. If an answer has not been confirmed, explain that the information will be checked with the technical team and provided later.
• Prepare a short, structured summary after each call.
Requirements
• Strong spoken English at a practical B2+ level or higher.
• 2–5 years of relevant professional experience.
• Knowledge of Windows and network fundamentals, endpoint security, AV/EDR, vulnerability management, penetration testing, and Red Team concepts.
• Ability to understand technical questions and clearly explain cybersecurity concepts without relying on a prepared script.
Relevant professional backgrounds may include cybersecurity technical or product support, security consulting, SOC L2, endpoint security, solutions engineering, technical presales, and junior or mid-level penetration testing.
Engagement and compensation
• Fully remote, part-time contractual engagement.
• No fixed monthly working hours.
• Approximately 5–10 completed vendor calls per month.
• Calls are arranged in advance and require availability during agreed periods overlapping with European business hours.
• Compensation is USD 30 before taxes per completed vendor call.
• Expected monthly compensation is USD 150–300, depending on the number of completed calls.
• This is not a full-time salaried position. The annual salary range displayed on the platform is an estimated annual equivalent based on the expected call volume.
Selection process
• Short screening call with the manager, including a live English conversation.
• Rapid-learning exercise based on public documentation for an unfamiliar cybersecurity product.
• Short simulated vendor call focused on product understanding, technical communication, and handling unknown questions.
• Final interview.
Offensive-security tasks will not be performed during the assessment.
IT Systems Engineer
Location: Bengaluru, India · On-site | Experience: 5+ years in IT systems / infrastructure
Department: IT & Information Security | Employment Type: Full-time | Reports To: Engineering Leadership
Focus: Own the identity, endpoints, network, and compliance backbone that powers immersive technology at
scale.
The Mission
About Metadome.ai
Metadome.ai is an immersive 3D & XR technology company that enables cloud-based, photorealistic, and captivating customer experiences for brands. Our technology offers a complete stack for creating immersive 3D & XR applications with omni-channe deployment across both in-store and digital touchpoints, and over a multitude of devices. These experiences span a spectrum of use cases across the automotive, home décor, fashion, and cosmetics & accessories sectors. Our flagship automotive platform — Autodome — enables unprecedented photorealistic, cloud-based immersive 3D & XR applications that cover the entire pre-retail funnel, empowering brands to launch products virtually and drive awareness, engagement, and bookings among modern automotive consumers. Today, we are trusted partners to leading brands across the globe — including Unilever, MG Motor, Lexus, Asian Paints, Tata Motors, and Royal Enfield, among others. We have also partnered with the likes of TCS, SAP , and PwC, and are an active voice in the XR community, including the
Metaverse Standards Forum and the VR/AR Association.
About the Role
We are looking for a hands-on IT Systems Engineer to own and run the technology backbone that keeps our teams productive and our data secure. You will be the single point of accountability for IT operations and information security across a multi-location business where 24x7 systems availability is core to how we operate — managing identity, endpoints, network, and our cloud workspace, while operating and continuously hardening our GDPR, SOC 2, and ISO 27001 compliance posture.
This is a builder-operator role, not a supervisory one. We run a tight ship on security and compliance, and we expect you to have personally implemented and operated the systems and controls described below — you should know them inside out, down to the configuration, the evidence, and the edge cases.
Core Responsibilities
● Identity & Access Management — JumpCloud:
○ Own the JumpCloud directory end-to-end: user lifecycle (joiner / mover / leaver), groups, and organizational structure.
○ Administer SSO, enforce MFA, and configure conditional and device-based access policies across all SaaS applications.
○ Manage cross-platform device policies (macOS, Windows, Linux) via JumpCloud device management, including disk encryption and compliance baselines.
○ Integrate RADIUS / LDAP for Wi-Fi and application authentication.
○ Automate onboarding and offboarding to guarantee least-privilege access and clean, auditable deprovisioning.
● Google Workspace Administration — GWS:
○ Administer the Google Workspace tenant: users, groups, organizational units, and email routing.
○ Configure and enforce security controls — 2-Step Verification, context-aware access, DLP rules,
and sharing / visibility policies.○
○ Manage retention, eDiscovery, and legal holds through Google Vault. Optimize licensing and SaaS spend across Workspace and other portals.
Endpoint & Threat Protection — Sophos:
○ Deploy, configure, and manage Sophos Central (Intercept X / XDR) across all endpoints and
servers.
○ Monitor alerts, triage threats, and lead incident detection, response, and remediation.
○ Maintain endpoint encryption, web / application control, and device-hardening standards.
○ Where Sophos Firewall is in use, manage firewall policies, IPS, and secure remote access.
Network, Firewall & Wi-Fi:
○ Design, configure, and maintain firewalls, VLAN segmentation, VPN, and secure remote access.
○ Administer enterprise Wi-Fi and wired networks (switches, access points), including
RADIUS-backed authentication.
○ Manage LAN / WAN connectivity, ISP relationships, and network performance and uptime.
○ Implement network monitoring, intrusion detection, and centralized logging.
Hardware, Software & Asset Management:
○ Own the full hardware lifecycle — procurement, provisioning / imaging, maintenance, repair, and
decommissioning.
○ Support a mixed fleet of macOS, Windows, and Android devices, including high-performance workstations and XR / VR hardware used by our creative and engineering teams.
○ Maintain an accurate hardware and software inventory and asset register.
○ Manage software deployment, patch management, and license compliance.
Security, Risk & Compliance — GDPR · SOC 2 · ISO 27001:
○ Operate and continuously improve the company's Information Security Management System
(ISMS).
○ Own day-to-day compliance for GDPR, SOC 2 (Type II), and ISO/IEC 27001 — including control
implementation, evidence collection, and continuous monitoring.
○ Conduct risk assessments, internal audits, periodic access reviews, and vendor security / DPA
assessments.
○ Serve as a primary point of contact during external audits and customer security reviews.
○ Maintain security policies, records of processing (RoPA), DPIAs, and incident / breach-response
runbooks.
○ Drive security-awareness and phishing-simulation programs across the organization.
IT Operations & Support:
○ Ensure 24x7 high availability of core systems and meet defined uptime and SLA metrics.
○ Provide escalation-level troubleshooting and support across macOS, Windows, and Android.
○ Manage backups, disaster recovery, and business-continuity testing.
○ Coordinate internal teams and third-party vendors to deliver IT projects on time and within
budget.
○ Maintain documentation, runbooks, and standard operating procedures.
○ Own and report on the IT budget and asset allocation.
Required Skills & Experience
● 5+ years in IT systems / infrastructure engineering — with direct, hands-on ownership of the systems
below rather than purely supervisory exposure.
● JumpCloud — demonstrated hands-on expertise across identity, SSO, MFA, and device management.
● Google Workspace (GWS) — deep admin-console experience including security, DLP , and Vault.
● Sophos — hands-on endpoint / XDR administration and threat response.
● Networking — firewall configuration, Wi-Fi, VLANs, VPN, LAN / WAN, and RADIUS / LDAP fundamentals.
● GDPR, SOC 2 & ISO 27001 — hands-on — you have personally taken an organization through at least one
full audit / certification cycle and know the controls, evidence, and auditor expectations inside out.
Cross-platform support — proven troubleshooting across macOS, Windows, and Android in a 24x7, multi-location environment.
System security — solid grasp of IDS / IPS, endpoint hardening, encryption, and backup / recovery.
Education — B.Sc. / B.Tech in Information Technology, Computer Science, or a related discipline.
Mindset — strong documentation discipline, ownership, resourcefulness, and a structured, problem-solving approach.
Preferred Qualifications
●Relevant certifications — e.g., ISO 27001 Lead Implementer / Auditor, CompTIA Security+ / Network+, or vendor certifications from JumpCloud and Sophos.
●Experience with compliance-automation platforms such as Sprinto, Vanta, or Drata.
●Scripting and automation for IT operations (Bash, PowerShell, or Python).
●Experience in a fast-paced SaaS or technology company serving enterprise and global clients.
●Familiarity with supporting creative, 3D, or XR workflows and high-performance computing environments.
Why Join Us
You will own the systems and security posture of a company building category-defining immersive technology for some of the world's most recognizable brands. It is a high-trust, high-ownership role with the autonomy to design things properly — and the visibility that comes with keeping a security- and compliance-first business running
flawlessly.
Amazon Web Services (AWS)At Shipthis, we are building a better future for freight forwarders by evolving traditional operations into fully digital, efficient, and scalable systems. We’re a fast-growing product company where every individual has the opportunity to take ownership, move fast, and create real impact. If you enjoy solving complex problems, shaping products from the ground up, and influencing technical direction, Shipthis is the place for you.
Learn more at www.shipthis.co
Role Overview
We are looking for an associate-level SecOps Engineer to support security operations, compliance, endpoint management, cloud infrastructure, and DevOps engineering. The role will work closely with the CTO/CISO and engineering team. Security and compliance are core responsibilities; when those priorities are lighter, the engineer will focus on CI/CD, infrastructure automation, reliability, monitoring, performance, and cloud cost optimization.
What You’ll be Doing
Security Operations
- Monitor infrastructure, application, and security alerts and assist with incident investigation.
- Review access controls, privileged accounts, service accounts, permissions, and periodic access reviews.
- Support infrastructure hardening, logging, monitoring, backup, recovery, and other security controls.
- Track security issues and corrective actions through closure.
Vulnerability Management
- Run and review application and infrastructure vulnerability scans.
- Maintain a vulnerability register and coordinate remediation with engineering teams.
- Support VAPT and penetration-testing exercises and validate closure of findings.
- Monitor dependencies, containers, operating systems, and cloud infrastructure for known vulnerabilities and patching needs.
Compliance & Governance
- Support ongoing ISO/IEC 27001, SOC 2, GDPR, customer-security, and internal-policy requirements.
- Maintain audit evidence, control registers, security policies, procedures, risk items, and remediation records.
- Assist with internal/external audits, vendor assessments, customer security questionnaires, and asset inventories.
- Maintain evidence for access reviews, vulnerability management, incidents, onboarding/offboarding, backups, and infrastructure changes.
MDM & Endpoint Security
- Administer the company MDM platform and enroll/manage company laptops, desktops, and mobile devices.
- Maintain device inventory and monitor endpoint compliance.
- Enforce approved controls such as disk encryption, screen locks, password requirements, patching, and endpoint protection.
- Support employee device onboarding/offboarding, approved application deployment, lost/stolen-device procedures, and remote wipe where authorized.
- Maintain endpoint security and MDM evidence required for audits and troubleshoot enrollment or policy issues.
DevOps, CI/CD & Cloud
- Maintain and improve CI/CD pipelines, deployment workflows, build times, caching, and rollback processes.
- Support production and non-production cloud infrastructure, networking, DNS, TLS certificates, IAM, and secrets.
- Automate repetitive deployment, infrastructure, security, and compliance tasks.
- Improve monitoring, logging, alerting, reliability, resource utilization, and cloud costs.
- Troubleshoot pipeline, deployment, and infrastructure issues and participate in root-cause analysis.
Required Fundamentals
- Basic knowledge of Linux, networking, HTTP/HTTPS, DNS, TLS, Git, Docker, cloud computing, APIs, and web applications.
- Understanding of IAM, MFA, least privilege, vulnerabilities/CVEs, encryption, logging, patching, and secrets management.
- Strong troubleshooting, ownership, attention to detail, and willingness to learn.
Desired Qualifications
- 1–2 years of experience with strong fundamentals are welcome.
- Basic scripting knowledge in Python, Bash, or similar.
- Interest in cybersecurity, cloud infrastructure, automation, and troubleshooting.
- Exposure to AWS/GCP/Azure, Terraform, GitHub Actions, Cloudflare, OWASP, vulnerability scanners, MDM, ISO 27001, or SOC 2 is a plus, not mandatory.
We Welcome Candidates:
- Who can join immediately
- Female candidates returning to work after a career break are strongly encouraged.
We are an equal opportunity employer and are committed to fostering diversity and inclusivity. We do not discriminate based on race, religion, color, gender, sexual orientation, age, marital status, or disability status.
Job Synopsys
Location: Bangalore
Job Type: Full-time, Permanent
Experience: 1-2 years
Industry: Software Product
About Us
CLOUDSUFI is a Silicon Valley-based specialist Data Engineering & Cloud Technologies player with top-tier clients, favorable revenue mix, strong financial performance, and robust management. We pride ourselves in helping in the Data Discovery, Insights and Monetization for organizations. We offer quality of work, opportunities to learn new platforms/technologies that will help young engineers put themselves ahead in their careers compared to their peers in the IT Services industry. CLOUDSUFI is a Data Science and Product Engineering company building Products/Solutions for Technology and Enterprise industries leveraging the advent of Cloud Hyper Scalers and AI/ML, NLP technologies.
The organization is built to scale with strong external/ internal tech capabilities and governance standards. Started in 2019, CLOUDUSUFI is a family of 250 members working towards a common goal of making the enterprise data dance.
To know more, please visit https://cloudsufi.com
Our Values
We are a passionate and empathetic team that prioritizes human values. Our purpose is to elevate the quality of lives for our family, customers, partners and the community.
Equal Opportunity Statement
CLOUDSUFI is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified candidates receive consideration for employment without regard to race, colour, religion, gender, gender identity or expression, sexual orientation and national origin status. We provide equal opportunities in employment, advancement, and all other areas of our workplace. Please explore more at https://www.cloudsufi.com/
Role : Full-Time Individual Contributor (IC)
Reporting to : Solution Architect / Program Manager
Location : India Remote (Quarterly visits to Noida office)
Shift : 2PM-11PM IST
12x5 (On call duty)
Experience : 8-14 Years
ABOUT YOU
- 5+ years’ experience with AWS orchestration via Terraform script
- 5+ years’ experience with CloudWatch/CloudTrail/Guard Duty
- 5+ years’ experience with AWS WAF
- 4+ years’ experience with CloudFlare
- 3+ years’ experience with DataDog
- Experience with PagerDuty
- Ability to make nuanced threat assessments
- Experience in SOPHOS.
- Significant experience with PCI, SOC2, SOX, HIPAA, or other compliance regimes
- Experience in Infrastructure As Code – Ansible / Terraform/ CloudFormation
- Hands-on experience implementing various security tools in CI/CD pipeline
- Strong experience with any cloud service provider (AWS Preferred)
- Implement and oversee technological upgrades, improvements and major changes to the cloud security environment.
- Develop solutions, install/configure/integrate IT tools and security processes within an application or organization to help improve the overall IT security posture.
- Set up Static and Dynamic Code Analysis tools, review the results and explain any gaps and potential impact to the teams (development and operations).
- Penetration testing and container security.
- Evaluate and analyze threat, vulnerability, impact and risk to security issues discovered from security assessments.
- Assess current technology architecture for vulnerabilities, weaknesses and for possible upgrades or improvement
- Creating and managing security strategies
- Oversee information security audits, whether performed by organization or third-party personnel
- Develop, maintain and publish up-to-date information security policies, standards and guidelines.
- Preferred Certification - AWS Security/CISSP/CISM (Certified Information Security Manager)
ABOUT THE ROLE
- Work independently with vendors and collaborate with colleagues
- Experience negotiating remediation timelines and/or remediate found issues independently
- Ability to implement vendor platforms within CI/CD pipelines
- Experience managing/responding to incidents, collecting evidence, and making decisions.
- Working with vendors and HM Teams to deploy criteria within WAF and fine tuning it according to applications’ needs
- Multitasking and continuous ability to provide a high level of concentration for assigned projects.
- Good working knowledge of AWS security in general and familiarity of the AWS native security tools
- The candidate should be experienced and articulate, who is not going to get discouraged, despite meeting roadblocks, and will continue promoting security within the company.
- Ability to create DevSecOps security requirements while working on a project
- Ability to articulate security requirements during the Architecture meetings and working hand in hand with HM Applications and DevOps Principal Engineers
Follow CutshortShubham Vishwakarma
Full Stack Developer - Averlon