Senior Security Engineer

Location: Noida, India

Department: Platform Team- DevOps & Data Center

Experience: 4-8 Years

Role summary

What you'll do

• Design, deploy and operate our SIEM end to end: log sources, ingestion pipelines, parsing, retention, detection rules, alert routing and dashboards.
• Onboard logs from AWS (CloudTrail, GuardDuty, VPC Flow), Azure (Activity, Defender), Cloudflare, Google Workspace, Linux/Windows endpoints, firewalls and Kubernetes.
• Write and tune detection rules mapped to MITRE ATT&CK; drive alert noise down and signal up.
• Own incident response: triage, containment, root cause, post-incident reviews and runbooks.

• Harden AWS and Azure accounts: IAM least privilege, SCPs/Azure Policy, network segmentation, KMS, secrets management, CSPM findings to closure.
• Secure on-prem device farms and data-centre infrastructure: Linux and Windows hardening (CIS benchmarks), patching cadence, EDR coverage, privileged access.
• Manage firewall policy and change control; review and tighten rules across cloud security groups and on-prem firewalls.
• Own Cloudflare: WAF rulesets, rate limiting, bot management, DDoS posture, DNS and TLS hygiene.

• Administer Google Workspace security: SSO/SAML, MFA enforcement, OAuth app allow-listing, DLP, device policies, email authentication (SPF/DKIM/DMARC).
• Run joiner-mover-leaver access reviews and identity audits across SaaS.

• Build security into CI/CD: SAST, DAST, SCA, secrets scanning, container and IaC scanning (Trivy, Semgrep, Gitleaks, Checkov or equivalent) with sane fail gates.
• Set up continuous public-facing scanning of our attack surface: asset discovery, exposed ports/services, certificate and DNS monitoring, misconfiguration alerts.
• Review architecture and code for security-sensitive changes; partner with engineering on fixes rather than throwing reports over the wall.

• Plan and execute internal VAPT on web apps, APIs, mobile, cloud and network; coordinate external pentests and drive remediation to closure.
• Run the LambdaTest bug bounty program: scope, triage, severity rating (CVSS), researcher communication, payout recommendations, fix verification and duplicate handling.
• Hunt on our own platform the way an external researcher would; reproduce and weaponise findings to prove impact.
• Run purple-team exercises: emulate real attacker techniques (MITRE ATT&CK) against production-like environments, then confirm the SIEM detects them and close the gaps it misses.

• Own technical controls and evidence for SOC 2 Type II and ISO 27001; support customer security questionnaires and audits.
• Maintain security SOPs, baselines and runbooks; measure and report security posture to leadership.

Must-have skills and experience

• 5–8 years in security engineering with at least 3 years hands-on in a production cloud environment.
• Deployed or substantially rebuilt a SIEM (Wazuh, Elastic Security, Splunk, Microsoft Sentinel, Google SecOps or similar) including log onboarding and detection engineering.
• Deep AWS security (IAM, VPC, GuardDuty, Security Hub, KMS, Organizations) and working Azure security (Entra ID, Defender for Cloud, NSGs, Azure Policy).
• Strong Linux administration and hardening; competent Windows and Active Directory/Entra security.
• Hands-on firewall management (Palo Alto, Fortinet, pfSense/OPNsense or cloud-native) and network security fundamentals.
• Cloudflare or equivalent WAF/CDN: rule authoring, rate limiting, bot mitigation, incident tuning.
• Google Workspace security administration.
• Built DevSecOps pipelines: SAST/DAST/SCA/secrets/IaC scanning integrated into GitHub Actions, GitLab CI or Jenkins.
• Proven VAPT skill: web, API and cloud testing with Burp Suite, Nuclei, Nmap, Metasploit and manual methodology (OWASP Top 10, ASVS, PTES).
• Bug bounty track record on HackerOne, Bugcrowd, Intigriti or equivalent, as a hunter or triager, with reportable valid findings.
• Demonstrated experience on both red team (offensive testing, adversary emulation) and blue team (detection engineering, incident response, hardening); you can run a purple-team exercise end to end.
• Scripting in Python or Bash, plus Git; comfortable with Docker and Kubernetes security basics.
• Clear written communication: findings, runbooks and risk explanations that engineers and executives both understand.

Nice-to-have

• Certifications: OSCP, OSWE, CRTP, AWS Security Specialty, AZ-500, GCIH/GCIA or CISSP.
• Experience securing large device fleets (Android, iOS, macOS) or bare-metal data-centre environments.
• Kubernetes security depth: admission control, runtime detection (Falco), network policies, supply-chain signing.
• Threat modelling and secure design review for multi-tenant SaaS platforms.
• Published CVEs, conference talks, open-source security tooling or public write-ups.
• Experience with SOAR or automating response playbooks.
• Familiarity with GDPR, ISO 27701 or customer-facing security questionnaires (CAIQ, SIG).

Who you are

• Security-first, by default. You treat every design, deploy and access request as a security decision. You push for secure defaults up front instead of bolting on controls after an incident.
• Hands-on. You would rather fix the IAM policy, write the detection rule or reproduce the exploit yourself than file a ticket and wait.
• Attacker's mindset. You think about how systems break, chain small weaknesses into real impact, and prove it rather than theorise.
• Pragmatic. You rank risk by real exploitability and business impact, ship controls that engineers will actually keep, and know when a compensating control beats a perfect one.
• Builder and owner. You are comfortable starting from zero, with no SIEM, no pipeline gates and no bounty program, and turning that into a running system with metrics.
• Clear communicator. You write findings engineers can act on and risk summaries leadership can decide on.
• Calm under incident. You lead triage without drama, document as you go, and turn every incident into a detection or control improvement.

First 90 days

Interview process

1. Recruiter screen (30 min): background, motivation, logistics.
2. Technical deep-dive with hiring manager (60 min): walk through a SIEM you built, a pipeline you secured and a bounty or VAPT finding you are proud of.
3. Hands-on assessment (take-home or live, 2–3 hours): a scoped target with cloud misconfigurations and a vulnerable web app; we score methodology, findings and the quality of the write-up.
4. Architecture and incident panel (60 min): threat-model a multi-tenant device-farm platform and run a live incident tabletop.
5. Leadership conversation (30 min): ownership, communication and culture fit.