Principal Security Engineer

Cashfree; Bengaluru; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Cashfree Payments is seeking a Principal Security Engineer to own and elevate the organization’s security posture across applications, cloud, and detection. This engineering-driven leadership role partners with Engineering, Platform, and GRC teams to define standards, guardrails, and architectural baselines.

The role is hands-on and independent, focusing on scalable security systems and automation to drive measurable improvements without a linear headcount expansion.

Qualifications

• B.Tech in Computer Science, Electrical, or Computer Engineering, or equivalent work experience as a software engineering or security practitioner.
• 9+ years of deep hands-on security engineering experience (or equivalent architectural depth).
• Proven track record of independently driving security transformation.
• Strong expertise in: AWS security architecture, Kubernetes & container security, Secure SDLC & CI/CD integration, IaC security, API & authentication security, Vulnerability lifecycle management, and Detection engineering.
• Experience correlating technical risk to business impact.
• Ability to operate effectively without detailed managerial direction.

Responsibilities

• Define and track measurable KPIs (risk reduction, MTTR).
• Architect multi-account AWS environments and secure Kubernetes (EKS) with Zero Trust principles (mTLS, OAuth2, OIDC, JWT).
• Embed security controls into Infrastructure-as-Code (Terraform) and shift-left DevSecOps automation.
• Oversee VAPT engagements and lead structured threat modeling (STRIDE).
• Design scalable detection strategies using cloud-native telemetry and SIEM/SOAR, and lead incident response.

Skills

AWS security

Kubernetes security

CI/CD security

IaC security

API security

Vulnerability management

Detection engineering

Threat modeling

Education

B.Tech in CS/Electrical/CE

Tools

Terraform

SIEM/SOAR

CloudTrail

Job description

End-to-End Security Posture, Architecture & Automation Leadership

Location: Bangalore (Work From Office)

Reports to: CISO

Cashfree Payments manages mission-critical payment and API infrastructure under RBI and

PCI-DSS compliance. We require uncompromising security and resilience to handle

high-volume financial transactions. We are building an automation-first, intelligence-driven

security organization designed to scale with business growth without linear headcount

expansion.

Role Summary

The Principal Security Engineer owns the security engineering strategy across application, cloud, and detection. This role partners closely with Engineering, Platform, and GRC teams, with the authority to define security standards, guardrails, and architectural baselines.

This is an engineering-driven security leadership position, not a ticket-triage or compliance reporting role.

We seek a highly autonomous, hands-on security engineer to own and elevate the organization’s security posture end-to-end. This is a builder’s role focused on designing scalable systems.

The role requires someone who:

• Operates independently, converting ambiguity into structured execution.
• Defines measurable security KPIs and delivers sustained improvement.
• Engineers scalable automation across the security lifecycle.
• Leads technical decision-making and mentors team members.
• Leverages AI and emerging technologies to amplify security impact.

Key Responsibilities

Enterprise Security Posture & Risk Engineering

• Define and track measurable KPIs (risk reduction, MTTR).
• Design and operationalize vulnerability lifecycle management.
• Translate RBI and PCI-DSS expectations into automated technical controls and build engineering-driven audit readiness frameworks.
• Identify and eliminate systemic security weaknesses.

Secure Architecture & Cloud Security Engineering

• Architect and secure multi-account AWS environments, hardening Kubernetes (EKS). Implement Zero Trust principles (mTLS, OAuth2, OIDC, JWT).
• Engineer IAM, secrets management, encryption controls, and network segmentation
• Embed security controls into Infrastructure-as-Code (Terraform). Shift-Left & DevSecOps Automation at Scale

Offensive Security & Threat Modeling Leadership

• Oversee and coordinate periodic VAPT engagements (internal and external).
• Conduct advanced white-box security assessments and lead structured threat modeling (STRIDE).
• Review authentication/authorization logic, evaluate API attack surfaces, and demonstrate exploitability where necessary.

Detection Engineering, Incident Leadership & Response Maturity

• Design scalable detection strategies using cloud-native telemetry (CloudTrail, Kubernetes logs) and SIEM/SOAR.
• Engineer contextual alerting, lead technical response during incidents, drive root cause analysis, and improve detection/response automation.

AI-Driven Security Innovation

• Implement AI-assisted secure code review and vulnerability triage.
• Identify and mitigate LLM security risks.
• Automate prioritization using contextual risk signals and continuously evaluate emerging AI-driven security technologies.

Technical Leadership & Team Elevation

Mentor team members, establish reusable security frameworks and engineering standards, influence architecture decisions, and build scalable security systems.

Technology Environment

• AWS (multi-account architecture)
• CI/CD pipelines (Git-based workflows)
• Infrastructure as Code (Terraform)
• Centralized logging and monitoring stack

Required Qualifications and Expertise

• B.Tech. in Computer Science, Electrical, or Computer Engineering, or equivalent work experience as a software engineering or security practitioner.
• 9+ years of deep hands-on security engineering experience (or equivalent architectural depth).
• Proven track record of independently driving security transformation.
• Strong expertise in: AWS security architecture, Kubernetes & container security, Secure SDLC & CI/CD integration, IaC security, API & authentication security, Vulnerability lifecycle management, and Detection engineering.
• Experience correlating technical risk to business impact.
• Ability to operate effectively without detailed managerial direction.

What Excellence Looks Like

• Critical vulnerabilities decline structurally.
• Detection and remediation timelines consistently improve.
• Audit cycles become predictable and engineering-driven.
• Security scales without proportional headcount growth.