DevSecOps Engineer

SourcingXPress; Bengaluru; On-site; INR 1,000,000 - 1,500,000; Full time

Job summary

SourcingXPress is seeking a Security Engineer to protect its cloud infrastructure and data. The ideal candidate will have 3+ years of experience in Security Engineering, proficient with Docker and Kubernetes, and have solid knowledge of web and API security. Responsibilities include conducting vulnerability assessments, managing security incidents, and collaborating across teams. The role offers the chance to work with millions of users, tackle high-traffic security challenges, and be part of a modern engineering culture with significant ownership on architectural decisions.

Qualifications

• 3+ years of hands-on experience in Security Engineering, Cloud Security, or Security Operations.
• Strong experience with Docker, Kubernetes, and cloud platforms.
• Solid understanding of web and API security (OWASP Top 10).
• Hands-on experience with VAPT tools.
• Experience securing backend systems (Node.js preferred).

Responsibilities

• Secure and manage cloud-native infrastructure running on Docker and Kubernetes.
• Perform Vulnerability Assessment and Penetration Testing for applications.
• Monitor security alerts and logs; investigate incidents.
• Deploy, configure, and maintain security tools.

Skills

Security Engineering

Cloud Security

Docker

Kubernetes

Vulnerability Assessment

Penetration Testing

Python

Bash

Tools

Burp Suite

Nmap

Nessus

Metasploit

Job description

About Us

Primetrace is the company behind Kutumb and Crafto, consumer products with 100M+ downloads, 3M+ daily active users, and traffic that scales 10–15x during special days. Security is critical to our platform reliability, user trust, and scale. We are looking for a Security Engineer who can take ownership of security across infrastructure, applications, and internal systems as we continue to grow.

Role Overview

As a DevSecOps Engineer, you will be responsible for protecting our cloud infrastructure, applications, and data. You will work closely with backend, DevOps, and product teams to proactively identify risks, design secure systems, and respond to security incidents in a high‑scale, cloud‑native environment. This role requires hands‑on technical execution, strong ownership, and the ability to balance security with product velocity.

Key Responsibilities

Infrastructure & Cloud Security

• Secure and manage cloud‑native infrastructure running on Docker and Kubernetes.
• Design and enforce Kubernetes security best practices (RBAC, network policies, secrets management, pod security).
• Harden cloud resources including IAM, networking, storage, and compute.
• Implement container image scanning, runtime security, and misconfiguration detection.

Application & Platform Security

• Perform Vulnerability Assessment and Penetration Testing (VAPT) for web applications, APIs, and backend services.
• Identify, validate, and prioritize vulnerabilities and work with engineering teams to drive remediation.
• Secure Node.js services, authentication flows, authorization models, and API gateways.
• Integrate security checks into CI/CD pipelines (SAST, DAST, dependency scanning).

Security Operations & Incident Response

• Monitor security alerts and logs; investigate and respond to incidents.
• Create and maintain incident response playbooks, runbooks, and post‑incident reports.
• Perform root‑cause analysis for incidents and recurring vulnerabilities.

Tooling, Automation & Governance

• Deploy, configure, and maintain security tools (vulnerability scanners, CSPM, SIEM, secrets scanners).
• Automate security checks and reporting using Python or Bash.
• Define and improve security policies, risk thresholds, and escalation processes.
• Support security audits, compliance requirements, and customer security reviews.

Collaboration & Enablement

• Work closely with DevOps, backend, mobile, and data teams to embed security early in the SDLC.
• Conduct security reviews, threat modeling sessions, and awareness initiatives.
• Translate technical security risks into business impact for leadership.

Required Qualifications

• 3+ years of hands‑on experience in Security Engineering, Cloud Security, or Security Operations.
• Strong experience with Docker, Kubernetes, and cloud platforms.
• Solid understanding of web and API security (OWASP Top 10).
• Hands‑on experience with VAPT tools such as Burp Suite, Nmap, Nessus, Metasploit.
• Experience securing backend systems (Node.js preferred).
• Familiarity with CI/CD security, secrets management, and vulnerability lifecycle management.
• Scripting experience in Python or Bash.
• Strong analytical skills and ownership mindset.

Preferred Qualifications

• Experience with container security, CSPM, or runtime security tools.
• Knowledge of security frameworks such as NIST, MITRE AT.
• Experience working on high‑traffic, consumer‑scale systems.
• Exposure to AI/ML or LLM security and data privacy.
• Participation in bug bounty programs or CTFs.
• Security or cloud certifications (CEH, OSCP, Security+, AWS/GCP/Azure Security).

Why Join Primetrace

• Work on products used by millions of users every day.
• Solve security problems at real scale with extreme traffic spikes.
• High ownership and direct impact on architecture decisions.
• Modern cloud‑native stack with strong engineering culture.