Senior Security Engineer

Overview

Hands-on Senior Security Engineer on Demandbase's Product Security team, owning cloud-security posture and risk reduction across AWS, GCP, Kubernetes, containers, virtual machines and infrastructure-as-code environments.

What you'll do

• Own cloud-security posture and risk reduction across AWS, GCP, Kubernetes, containers, virtual machines and supporting infrastructure services.
• Independently investigate complex misconfigurations and attack paths, determine actual exposure, and drive issues from discovery through verified closure.
• Partner with engineering teams to design secure, scalable solutions instead of relying only on tickets or compensating controls.
• Perform security reviews for new cloud services, infrastructure designs, network patterns, data flows, and high-risk architectural changes.
• Review Terraform and CI/CD workflows, and develop preventive controls that identify or block insecure infrastructure before deployment.
• Strengthen secure-by-default patterns for cloud accounts, projects, workloads, networking, storage, secrets, encryption, logging, and service-to-service access.
• Evaluate AWS IAM, GCP service accounts, workload identity, federation, trust relationships, and privileged access against least-privilege principles.
• Reduce excessive permissions, long-lived credentials, dormant identities, insecure keys, privilege-escalation paths, and cross-account or cross-project trust risks.
• Assess Kubernetes RBAC, workload identity, admission controls, network policies, secrets handling, runtime configurations, and cluster or workload isolation.
• Drive adoption of Demandbase-owned golden images, secure base images, automated upgrades, and timely remediation of critical and high-risk operating-system and package vulnerabilities.
• Improve the health of active container images and virtual machines while prioritizing resources that create meaningful production exposure.
• Lead risk-based triage of Wiz and other cloud-security findings; validate exploitability, identify root cause, recommend practical remediation, and eliminate avoidable noise.
• Build scripts, integrations, guardrails, dashboards, and automated remediation workflows for recurring cloud-security problems.
• Define and report outcome-oriented metrics for external exposure, IAM risks, Kubernetes issues, unhealthy VMs and container images, remediation aging, and recurrence.
• Support cloud incident investigations with attack-path analysis, evidence collection, blast-radius assessment, containment guidance, and durable corrective controls.
• Represent Product Security in technical discussions and risk escalations, influence teams without direct authority, and communicate trade-offs clearly.
• Mentor security and engineering team members, document reusable patterns, and help develop reliable secondary owners for cloud-security domains.

What you'll need

• 5+ years of experience in security, infrastructure, platform engineering, or a related technical field, including 4+ years of hands-on cloud-security experience.
• Deep practical knowledge of AWS/GCP in production environments.
• Strong knowledge of Kubernetes, containers, Linux, virtual machines, cloud networking, storage, secrets management, encryption, and logging.
• Hands-on expertise in cloud IAM, including AWS IAM, GCP service accounts, workload identity, federation, policy evaluation, and least-privilege design.
• Experience reviewing or developing Terraform and integrating security controls into CI/CD workflows.
• Experience using a CSPM platform such as Wiz to investigate and prioritize risk; the ability to go beyond tool output and validate technical impact is essential.
• Ability to automate security workflows using Python, Go, APIs, or similar technologies.
• Strong understanding of cloud attack techniques, privilege escalation, lateral movement, internet exposure, data exfiltration, and workload isolation.
• Demonstrated ability to own ambiguous problems, work independently, and drive cross-functional remediation to measurable completion.
• Excellent written and verbal English communication skills, including the ability to explain technical risk and remediation to engineers and leaders.

Nice to have

• Experience mentoring engineers or leading technical initiatives across multiple teams.
• Relevant certifications such as AWS Certified Security - Specialty, Google Professional Cloud Security Engineer, CKS, CISSP, or equivalent practical experience.

Details

• Location: Hyderabad.