SDE3, Infrastructure Security Engineer (DevSecOps)

Overview

Own security across Sarvam's CPU infrastructure: define and enforce security baselines for Kubernetes, cloud accounts, container images and CI/CD across all clouds, and build the automation that makes security a property of the pipeline rather than a review step. Hands-on role, with guidance and mentoring for engineering teams on security.

What you'll do

• Define and enforce security baselines for Kubernetes, cloud accounts, container images and CI/CD across all clouds
• Write the policy gates in the delivery pipeline (OPA / Conftest, Kyverno or equivalent): network exposure, IAM, image provenance, secrets, data residency
• Own secrets and workload identity: Vault or cloud-native equivalents, rotation, short-lived and scoped credentials, no long-lived keys
• Build detection and response: runtime security (Falco / Tetragon or equivalent), log-based detections, alerting and playbooks
• Run the finding-to-fix loop for security findings: triage, assign, fix, add a detection, retest
• Use LLMs and AI agents in security work: triaging findings, reviewing infrastructure changes, tuning detections, drafting incident timelines, and secure the agents themselves with scoped, short-lived permissions and audit trails
• Harden the supply chain: image signing and scanning, dependency policy, SBOMs
• Automate compliance evidence (CERT-In, ISO 27001, SOC 2, DPDP) together with the compliance team
• Set the security standards other engineers follow and review security-relevant changes
• Take part in on-call and lead security incidents

What you'll need

• 5–9 years in DevOps, platform or security engineering
• At least 2 years in a bank, fintech, payments company or other regulated environment
• Strong Kubernetes and Linux fundamentals; has run production clusters on at least one major cloud
• Hands-on with Terraform / OpenTofu and GitOps (ArgoCD or Flux)
• Has built security automation, not only operated tools: policy-as-code, secrets rotation, CI/CD security gates or detection pipelines
• Working knowledge of IAM, network security, TLS and secrets management across clouds
• Scripting and tooling in Python or Go
• Has been through security audits and knows what evidence auditors need
• Has built or used AI-based automation in infrastructure or security work, and understands the risks of AI agents: prompt injection, over-broad permissions, unreviewed actions

Nice to have

• Vault, SPIFFE / SPIRE, Falco or Tetragon, Cloudflare WAF
• Incident response lead experience
• Multi-cloud experience

Details

• Location: Bengaluru
• Participates in on-call rotation