Senior Security Engineer

LambdaTest; Dadri; Presencial; INR 2.500.000 - 4.000.000; Jornada completa

Descripción de la vacante

LambdaTest, Inc. is seeking a security engineer to build our SIEM from scratch and integrate security into CI/CD. You will lead red team activities (VAPT and bug bounty coordination) and blue team efforts (detection engineering, incident response, and hardening) across AWS, Azure, on-prem, and Google Workspace.

You will design end-to-end SIEM, onboard diverse log sources, tune detection rules, own incident response, and drive security improvements through automation and architecture reviews.

Formación

• 5–8 years in security engineering with at least 3 years hands-on in a production cloud environment.
• Deployed or rebuilt a SIEM including log onboarding and detection engineering.
• Deep AWS security and working Azure security experience.
• Strong Linux and Windows security handling.

Responsabilidades

• Design, deploy and operate SIEM end to end: logs, ingestion, parsing, retention, detection rules, alert routing and dashboards.
• Onboard logs from AWS, Azure, Cloudflare, Google Workspace, endpoints, firewalls and Kubernetes.
• Write detection rules mapped to MITRE ATT&CK and optimize alert noise.
• Own incident response: triage, containment, root cause, post-incident reviews and runbooks.
• Harden cloud and on-prem infrastructure; manage firewall policies and WAF rules.

Conocimientos

SIEM design

Cloud security

VAPT

Incident response

Red team & blue team

Python Bash scripting

Docker Kubernetes security

MITRE ATT&CK

Herramientas

Wazuh

Elastic Security

Splunk

Microsoft Sentinel

Burp Suite

Nuclei

Nmap

Metasploit

Descripción del empleo

This is a builder role, not an advisory one. You will stand up our SIEM from scratch, wire security into CI/CD, run continuous external scanning, lead VAPT, and run our bug bounty program. You work both sides: red team (attack our platform, run VAPT and bug bounty) and blue team (build detection, respond to incidents, harden everything). You bring an attacker's mindset and a security-first approach to every system you touch.

What you'll do

Blue team: detection & response (SIEM from scratch)

• Design, deploy and operate our SIEM end to end: log sources, ingestion pipelines, parsing, retention, detection rules, alert routing and dashboards.
• Onboard logs from AWS (CloudTrail, GuardDuty, VPC Flow), Azure (Activity, Defender), Cloudflare, Google Workspace, Linux/Windows endpoints, firewalls and Kubernetes.
• Write and tune detection rules mapped to MITRE ATT&CK; drive alert noise down and signal up.
• Own incident response: triage, containment, root cause, post-incident reviews and runbooks.

Cloud & infrastructure security (AWS, Azure, on-prem)

• Harden AWS and Azure accounts: IAM least privilege, SCPs/Azure Policy, network segmentation, KMS, secrets management, CSPM findings to closure.
• Secure on-prem device farms and data-centre infrastructure: Linux and Windows hardening (CIS benchmarks), patching cadence, EDR coverage, privileged access.
• Manage firewall policy and change control; review and tighten rules across cloud security groups and on-prem firewalls.
• Own Cloudflare: WAF rulesets, rate limiting, bot management, DDoS posture, DNS and TLS hygiene.

Corporate & identity security (Google Workspace)

• Administer Google Workspace security: SSO/SAML, MFA enforcement, OAuth app allow-listing, DLP, device policies, email authentication (SPF/DKIM/DMARC).
• Run joiner-mover-leaver access reviews and identity audits across SaaS.
• Build security into CI/CD: SAST, DAST, SCA, secrets scanning, container and IaC scanning (Trivy, Semgrep, Gitleaks, Checkov or equivalent) with sane fail gates.
• Set up continuous public-facing scanning of our attack surface: asset discovery, exposed ports/services, certificate and DNS monitoring, misconfiguration alerts.
• Review architecture and code for security-sensitive changes; partner with engineering on fixes rather than throwing reports over the wall.

Red team: VAPT, bug bounty & adversary simulation

• Plan and execute internal VAPT on web apps, APIs, mobile, cloud and network; coordinate external pentests and drive remediation to closure.
• Run the LambdaTest bug bounty program: scope, triage, severity rating (CVSS), researcher communication, payout recommendations, fix verification and duplicate handling.
• Hunt on our own platform the way an external researcher would; reproduce and weaponise findings to prove impact.
• Run purple-team exercises: emulate real attacker techniques (MITRE ATT&CK) against production-like environments, then confirm the SIEM detects them and close the gaps it misses.

Compliance & governance

• Own technical controls and evidence for SOC 2 Type II and ISO 27001; support customer security questionnaires and audits.
• Maintain security SOPs, baselines and runbooks; measure and report security posture to leadership.

Must-have skills and experience

• 5–8 years in security engineering with at least 3 years hands-on in a production cloud environment.
• Deployed or substantially rebuilt a SIEM (Wazuh, Elastic Security, Splunk, Microsoft Sentinel, Google SecOps or similar) including log onboarding and detection engineering.
• Deep AWS security (IAM, VPC, GuardDuty, Security Hub, KMS, Organizations) and working Azure security (Entra ID, Defender for Cloud, NSGs, Azure Policy).
• Strong Linux administration and hardening; competent Windows and Active Directory/Entra security.
• Hands-on firewall management (Palo Alto, Fortinet, pfSense/OPNsense or cloud-native) and network security fundamentals.
• Cloudflare or equivalent WAF/CDN: rule authoring, rate limiting, bot mitigation, incident tuning.
• Google Workspace security administration.
• Built DevSecOps pipelines: SAST/DAST/SCA/secrets/IaC scanning integrated into GitHub Actions, GitLab CI or Jenkins.
• Proven VAPT skill: web, API and cloud testing with Burp Suite, Nuclei, Nmap, Metasploit and manual methodology (OWASP Top 10, ASVS, PTES).
• Bug bounty track record on HackerOne, Bugcrowd, Intigriti or equivalent, as a hunter or triager, with reportable valid findings.
• Demonstrated experience on both red team (offensive testing, adversary emulation) and blue team (detection engineering, incident response, hardening); you can run a purple-team exercise end to end.
• Scripting in Python or Bash, plus Git; comfortable with Docker and Kubernetes security basics.
• Clear written communication: findings, runbooks and risk explanations that engineers and executives both understand.

Nice-to-have

• Certifications: OSCP, OSWE, CRTP, AWS Security Specialty, AZ-500, GCIH/GCIA or CISSP.
• Kubernetes security depth: admission control, runtime detection (Falco), network policies, supply-chain signing.
• Threat modelling and secure design review for multi-tenant SaaS platforms.
• Published CVEs, conference talks, open-source security tooling or public write-ups.
• Experience with SOAR or automating response playbooks.
• Familiarity with GDPR, ISO 27701 or customer-facing security questionnaires (CAIQ, SIG).

Who you are

• Security-first, by default. You treat every design, deploy and access request as a security decision. You push for secure defaults up front instead of bolting on controls after an incident.
• Hands-on. You would rather fix the IAM policy, write the detection rule or reproduce the exploit yourself than file a ticket and wait.
• Attacker's mindset. You think about how systems break, chain small weaknesses into real impact, and prove it rather than theorise.
• Pragmatic. You rank risk by real exploitability and business impact, ship controls that engineers will actually keep, and know when a compensating control beats a perfect one.
• Builder and owner. You are comfortable starting from zero, with no SIEM, no pipeline gates and no bounty program, and turning that into a running system with metrics.
• Clear communicator. You write findings engineers can act on and risk summaries leadership can decide on.
• Calm under incident. You lead triage without drama, document as you go, and turn every incident into a detection or control improvement.

First 90 days

By Outcome

Day 30 Attack-surface inventory complete (cloud accounts, on-prem, SaaS, public assets). Continuous external scanning live with alerting. SIEM platform selected with a costed design signed off.

Day 60 SIEM ingesting AWS, Cloudflare, Google Workspace and endpoint logs with the first 20 high-value detections. Secrets, SCA and IaC scanning gating CI on core repositories. Bug bounty triage SLA defined and met.

Day 90 SIEM covering Azure, firewalls and Kubernetes with on-call alert routing. First internal VAPT cycle delivered with critical and high findings remediated. Cloudflare WAF baseline rolled out to all public properties. Security posture dashboard reported to leadership.

• Technical deep-dive with hiring manager (60 min): walk through a SIEM you built, a pipeline you secured and a bounty or VAPT finding you are proud of.
• Hands-on assessment (take-home or live, 2–3 hours): a scoped target with cloud misconfigurations and a vulnerable web app; we score methodology, findings and the quality of the write-up.
• Architecture and incident panel (60 min): threat-model a multi-tenant device-farm platform and run a live incident tabletop.
• Leadership conversation (30 min): ownership, communication and culture fit.