Sr. Software Engineer (SDE-3 DevOps & Security)

Pluang; Gurugram District; On-site; INR 3,000,000 - 5,400,000; Full time

Job summary

Pluang Technologies India Private Limited in Gurgaon, Haryana, India, is seeking a Sr. Software Engineer (SDE-3 DevOps & Security) with 4-6 years of experience to build and run core security engineering for a regulated fintech platform serving millions of users.

You will own four areas end to end: cloud and Kubernetes security, secure SDLC and supply chain, vulnerability management, and security partnerships with asset-class product squads.

Qualifications

• 5+ years in security engineering with hands-on cloud, platform or DevSecOps security in production.
• Experience mentoring engineers and explaining risk to engineers, auditors and leadership.
• Experience with cloud security design and IAM least-privilege concepts.

Responsibilities

• Cloud and Kubernetes security: Own the security posture of AWS, GCP and Kubernetes clusters.
• Secure SDLC and supply chain: Run automated security testing in CI/CD and protect build infrastructure.
• Vulnerability management at scale: Own full lifecycle of findings from scanners, pentests and bug-bounty programs.
• Application & API security: Conduct threat modeling, secure design reviews, and pentesting.
• Detection & incident response: Develop detection rules and lead incident containment and post-incident reviews.
• Mentorship: Coach engineers and drive secure-by-default architecture adoption.

Skills

Cloud security

Kubernetes security

DevSecOps

SAST

SBOMs

Threat modeling

Incident response

Python

Go

GitOps

Tools

AWS

GCP

Job description

Sr. Software Engineer (SDE-3 DevOps & Security) Pluang Technologies India Private Limited, Gurgaon, Haryana, India 4 - 6 Years Full Time

Job Description

About Pluang

Pluang is Indonesia’s leading multi-asset investment platform, offering products such as Crypto, US stocks, mutual funds, and gold. At Pluang, we’re on a mission to redefine the way people invest. As one of the fastest-growing fintech platforms in Indonesia, we empower users to achieve financial independence through a seamless, innovative, and secure investment experience. Explore more about us here!
Job RolePluang is hiring a Senior Security Engineer to build and run core parts of security engineering for our regulated fintech platform, which serves millions of users across Indonesia in stocks, crypto, gold and other assets.

This is a senior, hands-on individual-contributor role. You will own four areas end to end: cloud and Kubernetes security, secure SDLC and supply chain, vulnerability management at scale, and security partnership with our asset-class product squads. You will also contribute to application security, detection and incident response, and AI security, and mentor other engineers on the team.

You will join a mature program, with automated pipeline security, policy-as-code admission control, centralised logging and detection, a public bug-bounty program and ISO 27001 certification, and you will be expected to make it measurably better.

What you will inherit An established program with controls as code, GitOps delivery and ISO 27001 certification, on a modern stack spanning AWS, GCP, Kubernetes, policy-as-code, runtime detection and in-house AI-assisted security tooling, including agentic penetration testing.

Where we are investing Three priorities will define the security function over the next twelve months, and this role will help shape each of them.

AI agent security: guardrails, testing and access controls that make AI agents safe before they reach production.

Security 360: a continuous, company-wide view of security posture, with clear ownership of every gap.

Organisation-wide security: protection that extends beyond infrastructure to SaaS, endpoints and every engineering team.

How you will grow Your scope expands with your impact. As these initiatives mature, you will take on broader ownership and greater technical leadership.

What You Will Do

Primary ownership

Cloud and Kubernetes security: Own the security posture of our AWS and GCP environments and Kubernetes clusters: least privilege, workload identity, base-image hardening, admission policies, runtime detection and network segmentation, all deployed through GitOps.

Secure SDLC and supply chain: Run and extend automated security testing in CI/CD . Protect build infrastructure and artifacts, and keep findings flowing to service owners rather than piling up in dashboards.

Vulnerability management at scale: Own the full lifecycle of findings from scanners, pentests and our bug-bounty program. Fix at the source with hardened base images, secure paved-road templates and shared libraries, so one fix closes a whole class of findings.

Contribution areas

Application & API security: Conduct threat modeling, secure design reviews, and penetration testing across web, API, and mobile platforms, focusing on authentication, OWASP Top 10, and fraud/business-logic risks in financial flows.

Third-party integrations: Secure integrations with exchanges, liquidity providers, custodians, and payment gateways through robust API key management, callback verification, and vendor security reviews.

Detection & incident response: Develop detection rules, triage alerts, participate in the on-call rotation, and lead incident containment and post-incident reviews.

AI security: Implement data access controls, prompt-injection safeguards, and production guardrails for LLM features and AI agents, while enhancing internal AI-driven security tools.

Mentorship: Coach engineers, conduct code/design reviews, and drive adoption of secure-by-default architecture across engineering teams.

What We’re Looking For

Experience: 5+ years in security engineering, at least 3 of them hands-on in cloud, platform or DevSecOps security in production, including mentoring other engineers and explaining risk to engineers, auditors and leadership.

Kubernetes security: RBAC, network policies, admission controllers and runtime detection in live clusters.

Cloud security : IAM least-privilege design, workload identity, account and network hardening, and infrastructure as code. Deep experience in one cloud and working knowledge of the other.

CI/CD and supply-chain security: Implement and operate SAST, SCA, container scanning, secrets management and SBOMs in real pipelines, and you understand GitOps.

Vulnerability management at scale: risk-based triage and prioritisation, SLA management and automating remediation workflows across many teams, not just running scanners.

Cross-team influence: a track record of driving security outcomes across many engineering teams you don't manage, by prioritising, negotiating fixes and influencing without authority.

Coding: you write production-quality Python or Go to build security tooling and automation.

Incident response: you have worked a real security incident and can lead one in your domain to closure, including the post-incident review.

Nice to have

Application and API security depth: threat modelling, API authorisation and business-logic testing.

Detection engineering: building and tuning SIEM.

Offensive security: OSCP or equivalent, or pentest or red-team experience that shapes how you build defences.

Bug bounty: running a program on YesWeHack, HackerOne, Bugcrowd or similar.

AI and LLM security: OWASP LLM Top 10, prompt-injection testing, securing AI agents, or building LLM-based security tooling.

Identity engineering: SSO and SCIM rollouts, IdP consolidation or zero-trust access migrations.

Certifications: AWS Certified Security – Specialty, Google Cloud Professional Cloud Security Engineer or Certified Kubernetes Security Specialist (CKS).

Regulated-industry experience: fintech, crypto or similar, including ISO 27001, SOC 2 or PCI-DSS, ITGC/ITAC audits, custody and key management, or regulator interactions.

We are an equal-opportunity employer and value diversity at our company. We do not discriminate based on race, religion, colour, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Job Snapshot

Updated Date

19-10-2026

Job ID

JOBID_510

Department

Location