Platform & Security Engineer

Overview

Own the cloud infrastructure, platform security and reliability that protect sensitive traveller data at Atlys, as the second engineer on the Infra & Security team.

What you'll do

• Own cloud infrastructure: run and improve the Kubernetes platform on GCP (with some workloads on AWS).
• Make deployments repeatable and fast with multi-stage CI/CD, container promotion and GitOps.
• Make the platform observable and reliable: bring logs, metrics and traces into one place, set up trusted alerting, and take part in on-call and incident response.
• Keep an eye on cloud cost and catch anomalies early.
• Run the data layer: database performance optimizations, backups and access automation, plus caching and messaging infrastructure.
• Enforce least-privilege IAM across cloud, Kubernetes and GitHub; run zero-trust access to internal services, SSO, and clean offboarding.
• Design and harden access controls and audit logging for PII such as passports, financial documents and identity records.
• Add SAST, DAST, dependency and container scanning, and SBOMs to CI/CD; run vulnerability management and coordinate pentests.
• Find and validate application security issues (authorization, authentication, business logic, injection), drive fixes with service owners, and fix directly where it makes sense.
• Threat-model and harden AI agents and assistants that act on users' behalf: prompt injection, tool and OAuth scope permissions, data leakage between users, and secrets handling.

What you'll need

• 4+ years of experience in infrastructure, DevOps or security engineering, ideally at a product company handling sensitive or regulated data.
• Strong fundamentals in Linux, networking (DNS, TLS, HTTP, load balancing), containers and Kubernetes, and at least one public cloud.
• Understanding of security fundamentals (identity and access, encryption, secrets management, the OWASP Top 10), applied in production.
• Strength in either infrastructure or security, and a genuine desire to get good at the other.
• Ability to take ownership end to end, make pragmatic trade-offs between security, speed and developer experience, and explain risk clearly.
• Ability to write code to automate work (Python, Go or Bash) and comfort reading application code.
• Figures things out: reads the docs, uses AI tools well, tests assumptions and ships.

Nice to have

• Prior web or backend development experience.
• Exposure to compliance frameworks such as DPDPA, ISO 27001 or SOC 2.
• Experience securing LLM applications or AI agents.

Details

• Location: Delhi HQ.
• Relocation support is provided to move closer to the team.