Product Security Lead

InCred Financial Services; Bengaluru; On-site; INR 4,500,000 - 6,500,000; Full time

Benefits offered by this job

CISSP

CCSP

OSCP

Job summary

InCred Financial Services seeks a Product & Cloud Security Lead with 8–10 years of experience to own the security strategy for cloud systems and SaaS platforms. You will bridge security engineering with governance, guide secure SDLC, and mentor a high-performing team.

You’ll drive roadmaps, architect controls for AWS and containers, and integrate security into CI/CD processes while partnering with compliance to meet regulatory requirements.

Qualifications

• 8–10 years in Application/Product Security, Cloud Security Engineering, or DevSecOps with hands-on security initiatives.
• Deep hands-on knowledge of cloud IAM, network isolation, KMS, zero-trust, CSPM/CWPP platforms.
• Strong grasp of OWASP Top 10, API security, secure coding, OAuth 2.0/OIDC/SAML.
• Proficiency in Python, Go, or Bash to write automated security policies and integrations.
• Excellent risk communication translating security risk to business impact.

Responsibilities

• Define and execute the product and cloud security roadmap across engineering, product, and cloud operations.
• Architect and enforce security controls for AWS, containers (Kubernetes, Docker), and IaC (Terraform/CloudFormation).
• Conduct threat modelling (STRIDE/PASTA) and secure architecture reviews across pipelines.
• Embed security tooling into CI/CD with guardrails for secrets, dependencies, and policy-as-code (OPA).
• Lead cloud incident response, root-cause post-mortems, and vulnerability disclosure programs.
• Collaborate with Compliance to meet RBI, SEBI, ISO 27001, and DPDPA requirements.

Skills

Security leadership

Cloud security

Threat modelling

DevSecOps

Python/Go/Bash

Communication

Job description

We are seeking a Product & Cloud Security Lead with 8 to 10 years of experience to own and drive the end-to-end security strategy for our cloud systems and SaaS platform. In this leadership role, the candidate will bridge technical security engineering with strategic governance-architecting resilient cloud environments, embedding security into every phase of the software development lifecycle (SDLC), and mentoring a high-performing engineering team.

Key Responsibilities

• Strategic Security Leadership: Define and execute the product and cloud security roadmap, setting technical standards across engineering, product, and cloud operations.
• Cloud Architecture & Engineering: Architect and enforce security controls for AWS cloud infrastructure, container ecosystems (Kubernetes, Docker), and Infrastructure-as-Code (Terraform/CloudFormation).
• Application Security & Threat Modelling: Conduct comprehensive threat modelling (STRIDE/PASTA), secure architecture reviews, and automated SAST/DAST/IAST coverage across application pipelines.
• DevSecOps Integration: Embed security tooling directly into CI/CD workflows, establishing automated guardrails for secret scanning, dependency vulnerability management, and policy-as-code enforcement (OPA).
• Incident Response & Operations: Lead cloud incident response efforts, execute root-cause post-mortems, and manage vulnerability disclosure programs (Bug Bounty, penetration testing governance).
• Compliance & Stakeholder Alignment: Partner with Compliance teams to ensure infrastructure and product architecture satisfy RBI, SEBI, ISO 27001, DPDPA requirements.

Required Qualifications

• Experience: 8-10 years in Application/Product Security, Cloud Security Engineering, or DevSecOps, with demonstrated experience and hands‑on with security initiatives or engineering.
• Cloud & Infrastructure Expertise: Deep, hands‑on knowledge of cloud IAM, network isolation, key management (KMS), zero‑trust architecture, and CSPM/CWPP platforms (e.g., Wiz, Orca, GuardDuty, Prisma Cloud).
• Application & API Security: Strong grasp of OWASP Top 10, API security standards, secure coding practices, and identity protocols (OAuth 2.0, OIDC, SAML).
• Automation & Coding: Proficiency in Python, Go, or Bash to write automated security policies, custom integrations, and remediation scripts.
• Soft Skills: Excellent risk communication skills—able to translate complex security risks into clear business impacts for executives, product managers, and developers.

Preferred Certifications

• Certified Information Systems Security Professional (CISSP)
• Certified Cloud Security Professional (CCSP)
• Offensive Security Certified Professional (OSCP)