Senior Platform Engineer - Infrastructure & Security Mumbai · 5+ years · Full-time →

NyaayOS; Mumbai; On-site; INR 1,800,000 - 3,600,000; Full time

Job summary

NyaayOS in Mumbai, India, seeks its first platform engineer to own the cloud footprint, CI/CD, environments, releases, and uptime, building reproducible infrastructure from code while upholding DPDP data residency.

You will enforce security as engineering—secrets, least privilege, encryption, audit logging—and automate toil away, shaping multi-tenant isolation and a platform the rest of the team ships from without handholding.

Qualifications

• You have run production infrastructure on a major cloud and can defend the choices.
• Infrastructure as code and CI/CD you built rather than inherited.
• Security-first engineering with secrets management and least-privilege access.
• You debug production with logs, metrics, and traces.
• Around five years operating infrastructure in production.
• You write code to automate toil.

Responsibilities

• Manage cloud footprint and reproducible code from scratch.
• Get code to production with CI/CD, environments, releases, and rollbacks.
• Keep infrastructure running with uptime, cost, and capacity management.
• Improve observability: logs, metrics, traces, alerts.
• Ensure security as engineering: secrets, least-privilege, encryption, audit logging, tenant isolation.
• Ensure portability by staying on chosen cloud.

Skills

Production infrastructure management

Cloud operations

Incident response and postmortems

Automation

Security-first engineering

Tools

Terraform

OpenTofu

CI/CD pipelines

Containers (Kubernetes)

Logging/Observability

Job description

Our infrastructure will hold law firms' confidential work product, in India, under DPDP. A firm's security review decides whether we win the account. You'd be our first platform engineer, and you'd own that.

YOU WILL OWN

• The cloud footprint, defined in code and reproducible from scratch.
• Getting code to production. CI/CD, environments, releases, rollbacks. Engineers should ship without going through you.
• Keeping it running. Uptime, cost and capacity across data, storage and serving.
• Observability. Logs, metrics, traces, and alerts that fire on something real.
• Security as engineering, not policy. Secrets, least-privilege access, encryption, network boundaries, audit logging, tenant isolation. Your job is to make the secure path the easy path, so the rest of the team takes it without being told.
• Portability. We run on one cloud and intend to stay there by choice rather than by necessity. Nothing critical should be allowed to make that decision for us.

THE HARD PROBLEMS

• Keeping the data in the country, and proving it. DPDP means our data stays in India. Every service, backup, log line and third-party call has to respect that, and you need to be able to show a firm's security reviewer that it does. It reaches into decisions that don't look like data decisions: where a service sits, which vendors are usable, what a log line is allowed to contain.
• One tenant's material must never reach another. Firms hand us privileged work product. Isolation has to hold in storage, in queries, in logs, in backups, and in whatever gets built next, which means the platform enforces it rather than each engineer remembering to.
• More systems than people to run them. You can't fix that with headcount. It gets fixed with automation, boring defaults, and the judgment to push back on complexity that hasn't earned its keep.

WE ARE LOOKING FOR

• You've run production infrastructure on a major cloud and can defend the choices: networking, identity and access, storage, managed databases, and what you'd do differently now.
• Infrastructure as code and CI/CD you built rather than inherited. Terraform, OpenTofu or similar, containers orchestrated in production, and nothing important living only in a console.
• Security is how you build, not a phase at the end. Secrets management, least-privilege access, encryption in transit and at rest, network segmentation, audit logging. You've hardened something that was already live.
• You debug production. Logs, metrics and traces, and you write the postmortem afterwards.
• You write code, not just configuration, and use it to automate your way out of toil.
• Around five years operating infrastructure in production. What you've run matters more than the number.

NICE TO HAVE

• Multi-tenant SaaS with real isolation requirements, especially somewhere a customer audited you on it.
• Data residency work: DPDP, GDPR, or any regime where the physical location of the bytes is a legal question.
• Building toward SOC 2 or ISO 27001, treating audit logging, access review and change management as engineering rather than paperwork.
• Operating data pipelines or ML and inference workloads, including keeping compute spend honest.
• Cloud portability. You've kept a system movable, or moved one.
• Regulated or trust-sensitive domains. Legal, fintech, healthcare, govtech.

THIS ISN'T THE ROLE IF

• You want a large platform team around you. This is an ownership role.
• You reach for a tool because it's the tool everyone reaches for. We'll take the boring option a small team can actually run.
• You only want greenfield. Some of this is improving what already runs.
• You see security as someone else's ticket queue.
• You want to architect and hand off. You'll be in the code, in the pipeline config, and on the incident.