Senior Security Engineer

tecHindustan; Mohali; On-site; INR 3,200,000 - 5,200,000; Full time

Job summary

tecHindustan Solutions Private Limited seeks a security engineer to own security across the stack, including the applications, Kubernetes platform, and the pipelines that ship them on AWS and Azure. You will write code, build controls, and work with platform and backend teams to prevent breaches while meeting regulatory obligations.

The role emphasizes threat modeling, cluster hardening, secure design reviews, pipeline security, secret management, edge protection with Cloudflare, detection

Qualifications

• 4+ years in security engineering, with 3+ years securing cloud-native production systems on AWS or Azure.
• In-depth Kubernetes security: RBAC, network policies, admission controllers, and runtime hardening.
• Cloud security: identity, segmentation, key management, logging, guardrails.
• IaC and supply chain hardening using Pulumi or Terraform, with real tooling implemented.
• CDN/edge security with Cloudflare: WAF tuning, rate limiting, bot management, TLS.
• Threat modelling based on exploitability rather than scanner severity.
• Detection engineering and SIEM: writing rules and reducing noise.
• Incident response in production with post-incident write-ups.
• Scripting in Python, Bash, Go, or TypeScript.

Responsibilities

• Threat model the flows that matter — auth, sessions, payments, wallet, bonuses — and drive mitigations to closure
• Harden the clusters: RBAC, namespace boundaries, network policies, admission control, pod security, runtime posture
• Review design and code across Node.js and TypeScript services — API authz, input handling, the OWASP baseline enforced in practice
• Secure the pipeline: SAST, SCA and secret scanning as merge gates, image scanning and signing, pinned digests, least-privilege CI creds
• Own secrets and keys — sourcing, injection, rotation, revocation, KMS, and keeping credentials out of the repo and out of logs
• Tune the edge: WAF rules, rate limiting, bot and credential-stuffing controls, DDoS posture, origin protection
• Build detection: security telemetry pipeline, rules for account takeover and abuse, alerts people act on, runbooks you've actually rehearsed
• Run vulnerability management — triage by exploitability and blast radius, remediation SLAs, external pentest coordination and closure
• Produce the evidence auditors and regulators ask for: access control, audit trails, data residency, retention, change control
• Take part in incident response and write up what stops it recurring.

Skills

Threat modelling

Security engineering

Kubernetes security

Cloud security

IaC (Pulumi/Terraform)

Pipeline security

Cloudflare/WAF

Detection engineering

Incident response

Scripting (Python/Bash/Go/TypeScript)

Tools

Pulumi

Terraform

Cloudflare

Kubernetes

Job description

You'll own security across the stack — the applications, the Kubernetes platform they run on, the pipelines that ship them, and the edge in front. AWS and Azure. Hands-on, on a platform that moves money and verifies identity under regulatory obligation. You'll write code, build controls, break things on purpose, and sit with the platform and backend teams rather than filing findings and waiting.

Key Responsibilities

• Threat model the flows that matter — auth, sessions, payments, wallet, bonuses — and drive mitigations to closure
• Harden the clusters: RBAC, namespace boundaries, network policies, admission control, pod security, runtime posture
• Review design and code across Node.js and TypeScript services — API authz, input handling, the OWASP baseline enforced in practice
• Secure the pipeline: SAST, SCA and secret scanning as merge gates, image scanning and signing, pinned digests, least-privilege CI creds
• Own secrets and keys — sourcing, injection, rotation, revocation, KMS, and keeping credentials out of the repo and out of logs
• Tune the edge: WAF rules, rate limiting, bot and credential-stuffing controls, DDoS posture, origin protection
• Build detection: security telemetry pipeline, rules for account takeover and abuse, alerts people act on, runbooks you've actually rehearsed
• Run vulnerability management — triage by exploitability and blast radius, remediation SLAs, external pentest coordination and closure
• Produce the evidence auditors and regulators ask for: access control, audit trails, data residency, retention, change control
• Take part in incident response and write up what stops it recurring.

Skills & Experience

• 4+ years in security engineering, at least 3 securing cloud-native production systems on AWS or Azure
• Kubernetes security in depth: RBAC, network policies, admission controllers, runtime hardening, and the failure modes of each
• Cloud security depth: identity, segmentation, key management, logging, guardrails
• IaC and supply chain hardening with Pulumi or Terraform, plus tooling you've implemented rather than evaluated
• CDN and edge security, Cloudflare especially: WAF tuning, rate limiting, bot management, TLS, edge-to-origin trust
• Threat modelling with the judgement to rank risk by exploitability, not scanner severity
• Detection engineering and SIEM work — writing rules, cutting noise, proving coverage
• Incident response in production, including the write-up afterwards
• Scripting in Python, Bash, Go or TypeScript