Cloud & AI Security Architect

Overview

Staff Security Engineer to secure large-scale AWS and GCP cloud environments, and to extend cloud security practices to AI/ML workloads, including generative and agentic AI.

What you'll do

• Design, implement, and operate cloud security architectures across AWS and GCP, including organization and account structures, SCPs and organization policies, IAM and permission boundaries, KMS and encryption strategy, and VPC design and network segmentation.
• Build and maintain preventive and detective guardrails at scale, managing CSPM and security services (e.g., AWS Security Hub, GuardDuty, GCP Security Command Center) and automated remediation.
• Embed security into infrastructure-as-code pipelines (Terraform, CloudFormation), including policy-as-code, pre-deployment scanning, drift detection, and secure module patterns.
• Secure container and Kubernetes workloads (EKS, GKE), including image supply chain, runtime controls, and workload identity.
• Own vulnerability management across the cloud estate: continuous discovery and asset inventory, cloud-native and agent-based scanning, risk-based prioritization using exploitability and reachability context (e.g., EPSS, KEV, internet exposure), and driving remediation with workload owners against defined SLAs.
• Conduct security risk assessments, security design reviews, and threat modeling for cloud workloads, including AI/ML services and applications.
• Extend cloud security controls to AI/ML platforms and services (e.g., AWS Bedrock): data protection, access control, endpoint and API security, and controls for agentic AI components such as MCP servers and tool integrations.
• Develop and enforce security standards, policies, and baselines for cloud and AI/ML technologies, and drive their adoption across engineering teams.
• Collaborate with DevOps, Platform, Data, and Engineering teams to integrate security throughout the SDLC and ML lifecycle.
• Support monitoring and response for security incidents involving cloud and AI/ML infrastructure, ensuring rapid containment and remediation.

What you'll need

• Bachelor's degree or equivalent practical experience.
• 10+ years of overall security engineering experience, including security assessments, security design reviews, and threat modeling.
• 6+ years of hands-on cloud security engineering experience on AWS and/or GCP, with demonstrated depth in at least one and working proficiency in the other.
• Proven proficiency designing and implementing cloud-native security controls at scale: IAM, KMS, VPC and network segmentation, encryption, logging and detection, and multi-account/multi-project governance.
• Hands-on experience with infrastructure-as-code (Terraform, CloudFormation) and security automation.
• Experience running cloud vulnerability management programs, including risk-based prioritization and remediation tracking across multi-account environments.
• Working knowledge of AI/ML security risks (data privacy, model and endpoint security, prompt injection and related LLM threat vectors) and the ability to assess and quantify these risks using frameworks such as NIST AI RMF, OWASP Top 10 for LLM Applications, and MITRE ATLAS.
• Excellent analytical, problem-solving, and communication skills.
• Strong interpersonal skills with excellent written and verbal communication.
• Uncompromising personal and professional integrity and ethics.
• Clear articulation of complex technical concepts to both technical and non-technical stakeholders.
• Creative and analytical thinking to navigate challenges and develop practical solutions.
• Sound, risk-informed judgment, evaluating situations logically to make decisions and anticipate potential risks.
• Effective prioritization and deadline management while managing multiple stakeholders.

Nice to have

• Certifications such as AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, or CISSP.
• Direct experience securing managed AI platforms, including guardrails, data isolation, and compliance automation for generative and agentic AI.
• Familiarity with adversarial ML techniques (evasion, poisoning, model inversion/extraction, jailbreak testing) and responsible AI practices.
• Experience with CNAPP, container security, and Kubernetes security tooling.
• Experience working in agile, multicultural, and cross-functional teams.

Details

• Location: Bengaluru.
• Hybrid flexible working that focuses on outcomes over hours.