Cloud & Infrastructure Security Engineer

HRS; Bengaluru; On-site; INR 3,500,000 - 6,500,000; Full time

Job summary

HRS is seeking a Security Engineer focused on Cloud and Infrastructure to own and advance cloud security across our Bangalore environment. You will drive CSPM, IaC security, network segmentation, and secrets management, collaborating with security and engineering teams to reduce risk through automation.

You will prioritize exploitability over CVSS scores, integrate IaC policy gates into deployment pipelines, and lead quarterly security drills.

Qualifications

• Five or more years of cloud security engineering experience with hands‑on ownership of cloud security posture, IaC security, and cloud network architecture.
• Deep AWS, Azure, or GCP security experience with demonstrated posture improvement outcomes.
• Experience with secrets management platforms and credential rotation at scale.
• Familiarity with runtime security platforms and vulnerability prioritization based on exploitability rather than CVSS score alone.
• Experience integrating cloud security tooling with SIEM and asset inventory platforms.

Responsibilities

• Own and deploy the cloud security posture platform across all environments.
• Define and enforce secure baseline configurations encoded as policy as code.
• Integrate IaC scanning into Terraform and CloudFormation pipelines with policy gates.
• Design and maintain network segmentation across production, staging, development, and corporate networks.
• Manage secrets vaults and automate credentials rotation across environments.
• Ensure cloud assets are reflected in the central inventory with ownership and criticality.

Skills

Cloud security

CSPM

IaC security

Network security

Secrets management

Scripting (Python/Bash)

SIEM integration

Asset inventory integration

Tools

Terraform

CloudFormation

AWS

Azure

GCP

SIEM

Asset inventory platforms

Secrets management platforms

Job description

Security Engineer: Cloud and Infrastructure

Location: Bangalore, India
Team: Security Engineering
Reports to: VP Security (Europe)

About HRS

HRS Group is a global B2B SaaS company redefining how enterprises manage travel, lodging, meetings, and workforce accommodation. Trusted by some of the world’s largest corporations and public sector organizations, HRS operates across Europe, Asia, and the Americas, processing sensitive enterprise customer data, payment transactions, and PII at global scale across a cloud-native platform where AI agents develop, deploy, and operate software alongside human engineers.

This is not a legacy enterprise. HRS is actively building infrastructure where autonomous AI agents execute code, trigger deployments, and operate within production environments. The attack surface is real, the data is sensitive, and the customers are large enough to demand proof that it is protected.

About the Security Team

HRS is building its security function from a clean sheet, under explicit executive mandate to establish the highest security standards across the company and its product. The team operates a continuous security engineering model aligned to the NIST Cybersecurity Framework, with each engineer carrying primary accountability for a specific stage of that cycle. There is no outsourced SOC. The team owns detection, triage, containment, response, engineering, governance, and validation end to end, with AI-driven automation as the 24/7 operational backbone.

The operating philosophy is explicit: humans make decisions, systems enforce. You are not here to watch dashboards. You are here to build the automated controls, integrations, and enforcement mechanisms that make security a property of the platform rather than a layer bolted on top of it.

Why This Role Exists

HRS operates almost entirely in the cloud. The security posture of that infrastructure depends on accurate, continuously enforced configuration standards, runtime-aware vulnerability prioritization, and the elimination of misconfiguration as a primary attack vector. This role is the accountable engineer for cloud security posture, workload protection, IaC security, network segmentation, and secrets management across all HRS cloud environments. You make security a property of the infrastructure, not a layer applied on top of it.

What You Own

Cloud Security Posture Management

You deploy, configure, and tune a cloud-native security platform as the HRS CNAPP, covering cloud security posture management, workload protection, runtime detection, and context-aware vulnerability prioritization. You configure posture management policies to enforce the HRS technical security baseline. You ensure findings integrate into the central detection platform so all posture violations are visible for detection and response.

The key differentiator you manage: runtime context. A vulnerability that is never loaded into memory or not exploitable in the actual HRS environment does not need immediate remediation. A vulnerability on an internet-facing service that is runtime-exploitable requires hours, not days. You use this context to prioritize remediation and present exploitable risk scenarios rather than raw scanner scores. You run quarterly attack path analysis reviews to identify and close the highest-risk lateral movement paths.

Infrastructure as Code Security

• You define and maintain secure baseline configurations for all HRS cloud resource types, encoded as policy as code.

• You integrate IaC scanning into all Terraform and CloudFormation deployment pipelines: no infrastructure change deploys without passing security policy gates.

• You maintain a library of approved, security-hardened IaC modules for common resource types. New resource types introduced by engineering teams must be covered within 30 days of first use.

Network Security and Segmentation

• You design and maintain the target network architecture for all HRS cloud environments, with explicit segmentation between production, staging, development, and corporate networks.

• You enforce network access controls through security groups, NACLs, private endpoints, and service mesh policies.

• You run quarterly network access reviews to identify and remove overpermissive rules.

• You maintain a reliable baseline of normal traffic patterns to support command-and-control detection.

Secrets Management

• You own and operate the secrets management vault across all environments.

• You enforce automated secrets rotation for all service credentials, API keys, and certificates.

• You coordinate with the DevSecOps and AppSec engineer on secrets scanning coverage to ensure no static credentials exist in production. The target is zero static credentials in production environments.

Cloud Asset Discovery

You own the integration between the cloud security platform and the central asset inventory, ensuring all cloud assets are reflected in the authoritative inventory with ownership and criticality classification. Coverage gaps are your responsibility to close.

The Shared Engineering Foundation

All four Bangalore security engineers operate on a shared foundation.

• You contribute to multiple stages of the security cycle beyond your primary domain.

• You design for automation first.

• You document every control and configuration within 48 hours of a change. You report north star metrics weekly.

• You contribute to quarterly fire drills, tabletop exercises, and restore tests. You are cross-domain by expectation, not by exception.

What You Bring

• Five or more years of cloud security engineering experience with hands‑on ownership of cloud security posture, IaC security, and cloud network architecture.

• Deep AWS, Azure, or GCP security experience with demonstrated posture improvement outcomes.

• Experience with secrets management platforms and credential rotation at scale.

• Familiarity with runtime security platforms and vulnerability prioritization based on exploitability rather than CVSS score alone.

• Experience integrating cloud security tooling with SIEM and asset inventory platforms.

• Scripting capability in Python, Bash, or equivalent.

What Strong Looks Like

• Within 90 days: the cloud security posture platform is deployed across all environments, the CSPM baseline is defined, and critical findings have a remediation SLA in place.

• Within six months: IaC gates are live and blocking in all production pipelines, secrets rotation is automated, and cloud asset coverage in the asset inventory is at 95% or higher.

• Within twelve months: zero static credentials in production, attack path analysis is running quarterly, and cloud posture evidence is audit‑ready for SOC 2, ISO 27001, and CIS Benchmark assessments.

Who You Are

• You think like an attacker when you review infrastructure.

• You know that the most dangerous misconfigurations are the ones that look harmless in isolation and catastrophic in combination.

• You are not satisfied by a green dashboard. You want to know what the dashboard is not showing you.