Senior DevOps Engineer

Vidio; Jakarta Pusat; On-site; IDR 300,000,000 - 500,000,000; Full time

Job summary

Vidio is seeking a skilled Cloud Security Engineer to strengthen our security posture across production environments. You will implement guardrails as code, conduct continuous configuration assessment against CIS benchmarks, and drive remediation to completion.

The role involves infrastructure as code with Terraform (and alternatives), container security with Kubernetes, IAM least-privilege, and cloud-native tooling.

Qualifications

• Cloud security (required): IAM and least-privilege design, CIS benchmarks, host/OS hardening
• Secrets management and encryption at rest and in transit
• Hands-on experience with a Cloud Security Posture Management (CSPM) tool — Wiz, Prowler, Scout Suite, AWS Security Hub, or GCP Security Command Center
• A preventative, guardrails-as-code mindset over scan-and-ticket
• Endpoint management experience — Jamf, Intune, or Kandji (bonus)
• Monitoring/alerting experience — Datadog, Prometheus (bonus)

Responsibilities

• Cloud security posture across our environment — continuous configuration assessment against CIS benchmarks, drift detection, and driving remediation to done rather than to backlog
• Guardrails as code — SCPs, policy-as-code (OPA/Kyverno), and secure-by-default
• Terraform modules so misconfigurations are prevented, not just reported
• IAM and least-privilege at scale — access reviews, secrets management, key rotation, and killing standing over-permissive access
• Hardening of cloud hosts and servers — golden images, CIS-benchmarked baselines, patch cadence, and bastion/SSH controls
• Employee endpoint hardening (~30% of the role) — MDM, EDR, disk encryption, and OS baselines across the laptop fleet
• Security built into CI/CD and infrastructure automation — everything as code
• Partnering with and leveling up other engineers, making the secure path the easy default instead of a blocker
• Scaling all of the above to millions of users without slowing delivery down

Skills

Linux administration

Infrastructure as code

Containers & Kubernetes

Programming (Python, Ruby, or Go)

Networking fundamentals

Cloud platforms

Tools

Terraform

Ansible

Chef

Puppet

Kubernetes

Python

Ruby

Go

Job description

• Cloud security posture across our environment — continuous configuration assessment against CIS benchmarks, drift detection, and driving remediation to done rather than to a backlog
• Guardrails as code — SCPs, policy-as-code (OPA/Kyverno), and secure-by-default
• Terraform modules so misconfigurations are prevented, not just reported
• IAM and least-privilege at scale — access reviews, secrets management, key rotation, and killing standing over-permissive access
• Hardening of cloud hosts and servers — golden images, CIS-benchmarked baselines, patch cadence, and bastion/SSH controls
• Employee endpoint hardening (~30% of the role) — MDM, EDR, disk encryption, and OS baselines across the laptop fleet
• Security built into CI/CD and infrastructure automation — everything as code
• Partnering with and leveling up other engineers, making the secure path the easy default instead of a blocker
• Scaling all of the above to millions of users without slowing delivery down

- Strong Linux system administration

- Infrastructure as code — Terraform (or Ansible/Chef/Puppet)

- Containers and Kubernetes in production

- At least one high-level language: Python, Ruby, or Go, plus comfort writing

shell scripts

- Solid understanding of DNS, TCP/IP, HTTP, TLS, and CDN

- Hands-on with at least one major cloud: AWS, GCP, or Azure

Requirements — Cloud security (required):

- IAM and least-privilege design, not just usage

- CIS benchmarks and host/OS hardening baselines

- Secrets management and encryption at rest and in transit

- Hands-on experience with a Cloud Security Posture Management (CSPM) tool —

Wiz, Prowler, Scout Suite, AWS Security Hub, or GCP Security Command Center

- A preventive, guardrails-as-code mindset over scan-and-ticket

Bonus points:

- Endpoint management experience — Jamf, Intune, or Kandji

- A cloud security certification such as AWS Security Specialty or CKS

- Monitoring/alerting experience — Datadog, Prometheus

- Experience with high-traffic or streaming platforms

- Exposure to compliance frameworks (PCI-DSS, ISO 27001)

- Comfortable using AI/LLM tooling to accelerate IaC, runbooks, and triage —

with sound judgment about handling sensitive data