Senior Information Security Engineer (DevSecOps)

E-Commerce Industry

Senior Information Security Engineer (DevSecOps)

Peak Hire Solutions

Company

Home

Senior Information Security Engineer (DevSecOps)

at E-Commerce Industry

Agency job

via Peak Hire Solutions

6 - 10 yrs

₹30L - ₹50L / yr

Bengaluru (Bangalore)

Skills

Security Information and Event Management (SIEM)

Information security governance

ISO/IEC 27001:2005

Systems Development Life Cycle (SDLC)

Software Development

Software development methodology

CI/CD

Information security management system

Information security

Amazon Web Services (AWS)

Windows Azure

Microsoft Windows Azure

SQL Azure

Google Cloud Platform (GCP)

IDS

IPS

Kubernetes

RBAC

Network Security

Windows Runtime

GitHub

Encryption

Disk encryption

Identity management

Access control

Web application security

Cyber Security

Security awareness

Spring Security

Security operations

Data security

Report Conversion Tool

SCA

Root cause analysis

RCA

Penetration testing

Cloud Computing

Terraform

AWS CloudFormation

Docker

ISO/IEC 27000-series

NIST

NIST 800-53

NIST SP 800 Series

HIPAA

Threat analysis

Threat modeling

DLP

EMC RSA DLP

Vulnerability assessment

Vulnerability management

Vulnerability scanning

Google Cloud Storage

Oracle Cloud

Automation

Test Automation (QA)

Troubleshooting

Hardware troubleshooting

Software troubleshooting

Mechanical troubleshooting

Electronic troubleshooting

Oracle

Microsoft SQL Server

Microsoft Windows

AWS Lambda

AWS Simple Notification Service (SNS)

AWS RDS

AWS Elastic Beanstalk

AWS Simple Queuing Service (SQS)

AWS ECR

AWS Bedrock

IPsec

SENIOR INFORMATION SECURITY ENGINEER (DEVSECOPS)

Key Skills: Software Development Life Cycle (SDLC), CI/CD

About Company: Consumer Internet / E-Commerce

Company Size: Mid-Sized

Experience Required: 6 - 10 years

Working Days: 5 days/week

Office Location: Bengaluru [Karnataka]

Review Criteria:

Mandatory:

Strong DevSecOps profile
Must have 5+ years of hands-on experience in Information Security, with a primary focus on cloud security across AWS, Azure, and GCP environments.
Must have strong practical experience working with Cloud Security Posture Management (CSPM) tools such as Prisma Cloud, Wiz, or Orca along with SIEM / IDS / IPS platforms
Must have proven experience in securing Kubernetes and containerized environments including image security,runtime protection, RBAC, and network policies.
Must have hands-on experience integrating security within CI/CD pipelines using tools such as Snyk, GitHub Advanced Security,or equivalent security scanning solutions.
Must have solid understanding of core security domains including network security, encryption, identity and access management key management, and security governance including cloud-native security services like GuardDuty, Azure Security Center etc
Must have practical experience with Application Security Testing tools including SAST, DAST, and SCA in real production environments
Must have hands-on experience with security monitoring, incident response, alert investigation, root-cause analysis (RCA), and managing VAPT / penetration testing activities
Must have experience securing infrastructure-as-code and cloud deployments using Terraform, CloudFormation, ARM, Docker, and Kubernetes
B2B SaaS Product companies
Must have working knowledge of globally recognized security frameworks and standards such as ISO 27001, NIST, and CIS with exposure to SOC2, GDPR, or HIPAA compliance environments

Preferred:

Experience with DevSecOps automation, security-as-code, and policy-as-code implementations
Exposure to threat intelligence platforms, cloud security monitoring, and proactive threat detection methodologies, including EDR / DLP or vulnerability management tools
Must demonstrate strong ownership mindset, proactive security-first thinking, and ability to communicate risks in clear business language

Roles & Responsibilities:

We are looking for a Senior Information Security Engineer who can help protect our cloud infrastructure, applications, and data while enabling teams to move fast and build securely.

This role sits deep within our engineering ecosystem. You’ll embed security into how we design, build, deploy, and operate systems—working closely with Cloud, Platform, and Application Engineering teams. You’ll balance proactive security design with hands-on incident response, and help shape a strong, security-first culture across the organization.

If you enjoy solving real-world security problems, working close to systems and code, and influencing how teams build securely at scale, this role is for you.

What You’ll Do-

Cloud & Infrastructure Security:

Design, implement, and operate cloud-native security controls across AWS, Azure, GCP, and Oracle.
Strengthen IAM, network security, and cloud posture using services like GuardDuty, Azure Security Center and others.
Partner with platform teams to secure VPCs, security groups, and cloud access patterns.

Application & DevSecOps Security:

Embed security into the SDLC through threat modeling, secure code reviews, and security-by-design practices.
Integrate SAST, DAST, and SCA tools into CI/CD pipelines.
Secure infrastructure-as-code and containerized workloads using Terraform, CloudFormation, ARM, Docker, and Kubernetes.

Security Monitoring & Incident Response:

Monitor security alerts and investigate potential threats across cloud and application layers.
Lead or support incident response efforts, root-cause analysis, and corrective actions.
Plan and execute VAPT and penetration testing engagements (internal and external), track remediation, and validate fixes.
Conduct red teaming activities and tabletop exercises to test detection, response readiness, and cross-team coordination.
Continuously improve detection, response, and testing maturity.

Security Tools & Platforms:

Manage and optimize security tooling including firewalls, SIEM, EDR, DLP, IDS/IPS, CSPM, and vulnerability management platforms.
Ensure tools are well-integrated, actionable, and aligned with operational needs.

Compliance, Governance & Awareness:

Support compliance with industry standards and frameworks such as SOC2, HIPAA, ISO 27001, NIST, CIS, and GDPR.
Promote secure engineering practices through training, documentation, and ongoing awareness programs.
Act as a trusted security advisor to engineering and product teams.

Continuous Improvement:

Stay ahead of emerging threats, cloud vulnerabilities, and evolving security best practices.
Continuously raise the bar on a company's security posture through automation and process improvement.

Endpoint Security (Secondary Scope):

Provide guidance on endpoint security tooling such as SentinelOne and Microsoft Defender when required.

Ideal Candidate:

Strong hands-on experience in cloud security across AWS and Azure.
Practical exposure to CSPM tools (e.g., Prisma Cloud, Wiz, Orca) and SIEM / IDS / IPS platforms.
Experience securing containerized and Kubernetes-based environments.
Familiarity with CI/CD security integrations (e.g., Snyk, GitHub Advanced Security, or similar).
Solid understanding of network security, encryption, identity, and access management.
Experience with application security testing tools (SAST, DAST, SCA).
Working knowledge of security frameworks and standards such as ISO 27001, NIST, and CIS.
Strong analytical, troubleshooting, and problem-solving skills.

Nice to Have:

Experience with DevSecOps automation and security-as-code practices.
Exposure to threat intelligence and cloud security monitoring solutions.
Familiarity with incident response frameworks and forensic analysis.
Security certifications such as CISSP, CISM, CCSP, or CompTIA Security+.

Perks, Benefits and Work Culture:

A wholesome opportunity in a fast-paced environment that will enable you to juggle between concepts, yet maintain the quality of content, interact and share your ideas and have loads of learning while at work. Work with a team of highly talented young professionals and enjoy the comprehensive benefits that company offers.

SENIOR INFORMATION SECURITY ENGINEER (DEVSECOPS)

Key Skills: Software Development Life Cycle (SDLC), CI/CD

About Company: Consumer Internet / E-Commerce

Company Size: Mid-Sized

Experience Required: 6 - 10 years

Working Days: 5 days/week

Office Location: Bengaluru [Karnataka]

Review Criteria:

Mandatory:

Strong DevSecOps profile
Must have 5+ years of hands-on experience in Information Security, with a primary focus on cloud security across AWS, Azure, and GCP environments.
Must have strong practical experience working with Cloud Security Posture Management (CSPM) tools such as Prisma Cloud, Wiz, or Orca along with SIEM / IDS / IPS platforms
Must have proven experience in securing Kubernetes and containerized environments including image security,runtime protection, RBAC, and network policies.
Must have hands-on experience integrating security within CI/CD pipelines using tools such as Snyk, GitHub Advanced Security,or equivalent security scanning solutions.
Must have solid understanding of core security domains including network security, encryption, identity and access management key management, and security governance including cloud-native security services like GuardDuty, Azure Security Center etc
Must have practical experience with Application Security Testing tools including SAST, DAST, and SCA in real production environments
Must have hands-on experience with security monitoring, incident response, alert investigation, root-cause analysis (RCA), and managing VAPT / penetration testing activities
Must have experience securing infrastructure-as-code and cloud deployments using Terraform, CloudFormation, ARM, Docker, and Kubernetes
B2B SaaS Product companies
Must have working knowledge of globally recognized security frameworks and standards such as ISO 27001, NIST, and CIS with exposure to SOC2, GDPR, or HIPAA compliance environments

Preferred:

Experience with DevSecOps automation, security-as-code, and policy-as-code implementations
Exposure to threat intelligence platforms, cloud security monitoring, and proactive threat detection methodologies, including EDR / DLP or vulnerability management tools
Must demonstrate strong ownership mindset, proactive security-first thinking, and ability to communicate risks in clear business language

Roles & Responsibilities:

We are looking for a Senior Information Security Engineer who can help protect our cloud infrastructure, applications, and data while enabling teams to move fast and build securely.

If you enjoy solving real-world security problems, working close to systems and code, and influencing how teams build securely at scale, this role is for you.

What You’ll Do-

Cloud & Infrastructure Security:

Design, implement, and operate cloud-native security controls across AWS, Azure, GCP, and Oracle.
Strengthen IAM, network security, and cloud posture using services like GuardDuty, Azure Security Center and others.
Partner with platform teams to secure VPCs, security groups, and cloud access patterns.

Application & DevSecOps Security:

Embed security into the SDLC through threat modeling, secure code reviews, and security-by-design practices.
Integrate SAST, DAST, and SCA tools into CI/CD pipelines.
Secure infrastructure-as-code and containerized workloads using Terraform, CloudFormation, ARM, Docker, and Kubernetes.

Security Monitoring & Incident Response:

Monitor security alerts and investigate potential threats across cloud and application layers.
Lead or support incident response efforts, root-cause analysis, and corrective actions.
Plan and execute VAPT and penetration testing engagements (internal and external), track remediation, and validate fixes.
Conduct red teaming activities and tabletop exercises to test detection, response readiness, and cross-team coordination.
Continuously improve detection, response, and testing maturity.

Security Tools & Platforms:

Manage and optimize security tooling including firewalls, SIEM, EDR, DLP, IDS/IPS, CSPM, and vulnerability management platforms.
Ensure tools are well-integrated, actionable, and aligned with operational needs.

Compliance, Governance & Awareness:

Support compliance with industry standards and frameworks such as SOC2, HIPAA, ISO 27001, NIST, CIS, and GDPR.
Promote secure engineering practices through training, documentation, and ongoing awareness programs.
Act as a trusted security advisor to engineering and product teams.

Continuous Improvement:

Stay ahead of emerging threats, cloud vulnerabilities, and evolving security best practices.
Continuously raise the bar on a company's security posture through automation and process improvement.

Endpoint Security (Secondary Scope):

Provide guidance on endpoint security tooling such as SentinelOne and Microsoft Defender when required.

Ideal Candidate:

Strong hands-on experience in cloud security across AWS and Azure.
Practical exposure to CSPM tools (e.g., Prisma Cloud, Wiz, Orca) and SIEM / IDS / IPS platforms.
Experience securing containerized and Kubernetes-based environments.
Familiarity with CI/CD security integrations (e.g., Snyk, GitHub Advanced Security, or similar).
Solid understanding of network security, encryption, identity, and access management.
Experience with application security testing tools (SAST, DAST, SCA).
Working knowledge of security frameworks and standards such as ISO 27001, NIST, and CIS.
Strong analytical, troubleshooting, and problem-solving skills.

Nice to Have:

Experience with DevSecOps automation and security-as-code practices.
Exposure to threat intelligence and cloud security monitoring solutions.
Familiarity with incident response frameworks and forensic analysis.
Security certifications such as CISSP, CISM, CCSP, or CompTIA Security+.

Perks, Benefits and Work Culture:

Users love Cutshort

Read about what our users have to say about finding their next opportunity on Cutshort.

Shubham Vishwakarma

Full Stack Developer - Averlon

I had an amazing experience. It was a delight getting interviewed via Cutshort. The entire end to end process was amazing. I would like to mention Reshika, she was just amazing wrt guiding me through the process. Thank you team.

Companies hiring on Cutshort

Similar jobs

SDET

at i2b Technologies Pvt Ltd

1 candid answer

Posted by chaitanya v

Hyderabad

3 - 6 yrs

Best in industry

Test Automation (QA)

Mobile App Testing (QA)

Performance Testing

Appium

SDET — Software Development Engineer in Test

Mobile & Real-Time Systems | 3–5 Years | Hyderabad / Remote

We're hiring an SDET who thinks in test strategies, not just test cases. You'll own quality across mobile apps that handle live streaming, real-time chat, and high-concurrency interactive systems. You won't just find bugs — you'll design the systems that prevent them from reaching production.

WHAT YOU'LL DO

→ Own test strategy and automation across functional, integration, regression, and performance layers

→ Build scalable automation frameworks from scratch — not maintain someone else's

→ Test real-time data flows — WebSocket message ordering, reconnection logic, latency under load

→ Design and execute API contract tests; catch breaking changes before they hit staging

→ Run performance and load tests simulating thousands of concurrent users on live streams

→ Test edge cases — poor network, offline states, app backgrounding, memory pressure

→ Integrate test suites into CI/CD pipelines — every PR, every build

→ Analyse crash reports, ANRs, OOM events and build regression coverage around them

→ Participate in design reviews to ensure testability is built in from day one

SKILLS

★ Appium — iOS & Android mobile automation

★ JavaScript or Python — test scripting at depth

★ REST & WebSocket API testing

★ Performance testing — JMeter, k6, Gatling

★ CI/CD — GitHub Actions, Jenkins, or equivalent

★ Test framework design — POM, BDD, data-driven

★ Debugging tools — Charles Proxy, Proxyman, device logs

★ Mobile profiling — memory, CPU, FPS, battery

★ Test management — TestRail, Zephyr, or Jira Xray

★ Defect lifecycle & root cause analysis

★ Agile / shift-left testing mindset

★ Strong analytical & documentation skills

GOOD TO HAVE

◆ Push notification testing — FCM / APNs

◆ Cloud device farms — BrowserStack, Sauce Labs

◆ Monitoring integration — Sentry, Crashlytics, Datadog

◆ Chaos / fault-injection testing

◆ Docker / containerised test environments

◆ TypeScript proficiency

YOU'RE EXACTLY WHO WE WANT IF YOU'VE

✓ Built an automation framework end-to-end — architecture, not just scripts

✓ Tested a live product used by real users at meaningful scale (chat, streaming, gaming)

✓ Simulated real-world chaos — flaky networks, reconnects, device interruptions

✓ Caught a critical production bug through automation before any user reported it

✓ Worked with developers on testability during API or feature design — not after

✓ Reduced release cycle time through better automation coverage and CI integration