Director, Security

BOLD; Dadri; On-site; INR 3,500,000 - 7,500,000; Full time

Job summary

BOLD is seeking a Director of Security to own security across a large portfolio of client-facing products. Our platforms run on AWS and Azure, with AI features, and require secure-by-default architecture across cloud, edge, and APIs.

This is a builder role to design security into our architecture, delivery pipeline, and product features. You will lead a small security team, establish threat models, enforce guardrails, and partner with GRC and engineering to ensure compliance and risk reduction.

Qualifications

• 12+ years in security with leadership of a multi-product security function.
• Hands-on depth in cloud security on AWS and Azure.
• Proven track record securing AI/LLM-powered features.
• Strong background in application and API security.
• Experience with edge defenses in production.

Responsibilities

• Own AI and LLM security threat model and monitoring.
• Lead multicloud security architecture across AWS and Azure.
• Harden Kubernetes with admission control and network policy.
• Oversee edge defenses, DDoS mitigation, and WAF tuning.
• Run API security program across endpoints.
• Embed SAST, SCA, secrets scanning in CI/CD.
• Lead detection and incident response across cloud, Kubernetes, AI.
• Manage tooling budget and vendor negotiations.

Skills

Cloud security

Security leadership

Threat modeling

Incident response

Python scripting

API security

Communication

DevOps security

Tools

IAM policy reading

Terraform

Kubernetes manifests

CI/CD tooling

Job description

BOLD is looking for a Director of Security to own security across a large portfolio of client-facing products. Our products run on AWS and Azure, ship at high velocity across UI and backend, and make extensive use of AI and LLMs across the customer experience.

This is a builder’s role, not an audit role. You will design security into our architecture, our delivery pipeline and our AI features, and lead the team that keeps it there. Compliance, certificates and penetration testing are part of the remit, but they are outcomes of a well‑run program, not the program itself.

We want someone who has already thought hard about what changes when a product talks to a model: prompt injection and hijacking, data leaking through model context, agents with too much authority, and attackers who now use AI too.

+ What you’ll be securing:

Layer

What we run

What we need from you

Cloud

• AWS and Azure, multi-account / multi-subscription
• One identity, policy and posture model across both clouds

Compute

• Kubernetes (EKS / AKS), containers, CI/CD
• Supply‑chain integrity, runtime detection, least‑privilege workloads

Edge

• CDNs, WAF, bot detection agents
• Tuned defences against scraping, credential stuffing and AI‑driven bots

APIs

• Public and partner APIs behind API protection
• Discovery, schema enforcement, abuse and BOLA/BFLA detection

Applications

• Modern web front ends and backend services
• Secure‑by‑default frameworks and paved roads for engineers

AI

• Extensive use of AI and LLMs in client‑facing features
• An LLM threat model, guardrails, evals and monitoring in production

ABOUT THIS TEAM

BOLD Platform services team design, creates, manage and maintain the highly scalable and distributed services for the wider use of web and mobile product applications/portals/websites. The current list of services is based on Microservices architecture whose domain ranges from visitor tracking, User profiles, authentication, content and payments.

Platform team uses state of the art modern technologies like .Net framework, Python, Java, SQL Server, My SQL, Graph DB, SOLR, and a lot of other tools & technologies serving millions of users with hundreds of million transactions everyday through a scalable and fault tolerant architecture.

WHAT YOU’LL DO

• AI and LLM security: Own the threat model for every AI/LLM‑powered feature, covering prompt injection and prompt hijacking (direct and indirect), jailbreaks, system‑prompt and data leakage, insecure output handling, excessive agency in tool‑calling, and model denial‑of‑wallet.
• AI assurance: Build adversarial evals and red‑team exercises for AI features into the release process, with production monitoring for abuse and drift. Govern internal AI use, including coding assistants, agents with repo or cloud access, plugin integrations and shadow AI.
• Multicloud security: Set a unified security architecture across AWS and Azure: identity federation and guardrail policies. Harden Kubernetes with admission control, network policy, workload identity and runtime threat detection.
• Edge defences and real‑time tuning: Own edge security across every client‑facing product, working with Architecture and Technical Operations on real‑time tuning of DDoS mitigation thresholds, rate limits, bot‑score and challenge thresholds, and WAF rule sensitivity, balancing attacks blocked against false positives for real customers.
• API security: Run an API security program covering inventory of every endpoint, authentication and authorization patterns, rate limiting and abuse detection.
• Secure engineering: Build paved roads so the secure way is the easy way. Embed SAST, SCA, secrets and IaC scanning and SBOMs in CI/CD, secure the software supply chain, and lead design reviews and threat modelling as a peer to architects.
• Detection and response: Own detection engineering and incident response across cloud, Kubernetes, edge and AI layers, including runbooks for AI‑specific incidents, tabletop exercises and post‑incident reviews.
• Tooling and budget: Own the security tooling budget: build business cases, rationalise overlapping tools, negotiate with vendors and track spend against risk reduced. Partner with Architecture and Technical Operations on tooling decisions from evaluation to rollout, and agree who owns which detection thresholds during a live attack.
• Governance and compliance: Set direction for governance, risk and compliance, working with our in‑house GRC team, which owns day‑to‑day delivery. Ensure compliance with GDPR, PCI DSS and the EU AI Act is a byproduct of engineering controls, with automated evidence.
• Risk and assurance: Make the calls on high‑impact third‑party risk, especially AI providers. Scope and direct penetration tests and bug bounty, and represent security to enterprise clients on strategic deals.
• Leadership: Build and lead a small, high‑leverage team (application, cloud and AI security), work closely with our in‑house GRC team, grow security champions inside engineering, and report risk posture and program metrics to executive leadership in plain business terms.

WHAT YOU’LL NEED

• 12+ years in security, including 4+ years leading a security function in a product engineering organisation with a multi-product, client‑facing portfolio, including ownership of its tooling budget.
• Hands‑on depth in cloud security on both AWS and Azure; able to read an IAM policy, a Terraform plan and a Kubernetes manifest and spot the problem.
• Practical experience securing AI/LLM‑powered features in production, including defending against prompt injection and hijacking.
• Strong application and API security background: OWASP Top 10 and API Top 10, OAuth/OIDC, authorization design and secure SDLC.
• Experience running and tuning edge defences in production (CDN/WAF, DDoS mitigation, bot management and API protection platforms), including threshold tuning during live traffic events.
• Detection and incident response leadership, including at least one serious incident handled end to end.
• Has overseen compliance programs such as GDPR, PCI DSS or EU AI Act readiness alongside a GRC team.
• Comfortable writing code or scripts (Python, Go or similar) to automate, prototype and review.
• Communicates risk to engineers and executives with equal clarity, and earns trust by enabling delivery rather than blocking it.

WHAT’S GOOD TO HAVE

• Has built LLM red‑teaming or eval harnesses, or contributed to OWASP GenAI, MITRE ATLAS or similar work.
• Experience with AI gateways or LLM firewalls, and with securing agentic workflows.
• Background working alongside data science teams on model and data pipeline security.
• Familiarity with the OWASP Top 10 for LLM Applications and the NIST AI RMF.
• Certifications such as CISSP, CCSP, OSCP or cloud security specialties (valued, not required).

EXPERIENCE-

• Director, Security- 12years+

#LI-Hybrid

About Bold

We Transform Work Lives

As an established global organization, BOLD helps people find jobs. Our story is one of growth, success, and professional fulfillment. We create digital products that have empowered millions of people in 180 countries to build stronger resumes, cover letters, and CVs. The result of our work helps people interview confidently, finding the right job in less time. Our employees are experts, learners, contributors, and creatives.

We Celebrate And Promote Diversity And Inclusion

We value our position as an Equal Opportunity Employer. We hire based on qualifications, merit, and our business needs. We don’t discriminate regarding race, color, religion, gender, pregnancy, national origin or citizenship, ancestry, age, physical or mental disability, veteran status, sexual orientation, gender identity or expression, marital status, genetic information, or any other applicable characteristic protected by law.

Under San Francisco’s Fair Chance Ordinance, qualified applicants with arrest and conviction records will be considered for the position.