Staff Security Engineer

Experience: 10- 12 years

Staff Security Engineer Cloud Security, Infra Security and Security Ops|Bangalore Position Staff Security Engineer (Application & Cloud Security) Location Bangalore Company Tazapay – cross-border payment service provider Experience (8-14 years) in information security (application and cloud) Tech Stack AWS, Node.js, GoLang microservices, Docker, Kubernetes (EKS), Terraform About Tazapay Tazapay is a cross-border payment service provider offering local collections via local payment methods, virtual accounts and cards in over 70 markets. Merchants do not need to create local entities anywhere; Tazapay provides the compliance framework to handle local regulations and requirements. The result is lower transaction costs, FX transparency and higher authorisation rates. Tazapay is licensed and backed by leading investors (www.tazapay.com). Why Join Us This is an opportunity to join a fantastic crew before the rocket-ship launch: build something ground-up and see your work used and paid for by thousands of customers. You will be part of a growth story securing critical payment infrastructure spanning application and cloud security across 70+ markets. We believe in a culture of openness, innovation and great memories together. About the Role As a Senior Security Engineer, you will play a pivotal role in securing our entire technology stack, from application-level security to cloud infrastructure protection. You will lead security initiatives across our AWS environments and payment applications built with Node.js and GoLang microservices, leveraging AWS security services and modern security tooling to defend against evolving threats. The role combines deep technical expertise in application and cloud security with leadership responsibility. Key Responsibilities 1. Cloud Security Operations Design, implement and manage cloud security controls and enterprise-level security architecture across AWS; monitor posture and ensure secure configurations. Configure AWS Shield (Standard and Advanced) for DDoS protection; manage CloudFront security including advanced WAF rules, SSL/TLS and origin protection. Secure AWS services including EC2, ECS, EKS, Lambda, RDS, S3 and API Gateway across multi-region deployments. Design network security using VPC, Security Groups, NACLs, Transit Gateway and PrivateLink; manage firewalls, VPN and segmentation. Lead secure CI/CD pipelines for Node.js and GoLang microservices and integrate security into DevSecOps processes. Architect container security for Docker and Kubernetes (EKS); secure workloads, VMs, storage and databases. Manage CSPM and CWPP solutions; conduct cloud security assessments to identify misconfigurations, vulnerabilities and gaps. Implement cloud IAM, privileged access management (PAM) and least-privilege controls. Implement cloud security logging, monitoring and alerting aligned to organisational policy and regulatory requirements. 2. Security Operations Management Manage and optimise enterprise security solutions: SIEM, EDR/XDR, cloud, container and network security. Oversee day-to-day security operations across enterprise IT and cloud; monitor events, alerts and incidents. Define and improve monitoring use cases, correlation rules and detection capabilities. Lead threat detection, threat hunting and security event analysis. Manage vulnerability assessment and remediation, including risk prioritisation and tracking. Oversee endpoint, email, network and infrastructure security operations. Maintain procedures, playbooks, runbooks and escalation matrices; coordinate with SOC teams, MSSPs and external vendors. Drive continuous improvement in security operations efficiency and effectiveness. 3. Security Incident & Threat Management Lead response to incidents involving cloud infrastructure, endpoints, networks and enterprise applications, from investigation and containment to recovery. Perform root cause analysis and ensure corrective and preventive actions are implemented. Manage incident escalation and stakeholder communication; coordinate forensic investigations and post-incident reviews. Develop and maintain incident response plans and disaster recovery security procedures. Conduct threat intelligence analysis and incorporate IOCs into monitoring. Track incident metrics, response times and remediation effectiveness. 4. Security Governance & Risk Management Define and maintain security standards, policies, procedures and guidelines. Ensure compliance with ISO 27001, NIST Cybersecurity Framework, CIS Benchmarks, SOC 2, PCI DSS and GDPR (where applicable). Conduct periodic security reviews, risk assessments and control effectiveness assessments; support internal and external audits. Maintain risk registers, security exceptions and remediation tracking. Prepare security dashboards, management reports and operational KPIs. Required Qualifications Experience 8+ years in information security with demonstrated expertise in both application and cloud security. Extensive experience securing microservices architectures, particularly GoLang, Java or Scala. Advanced AWS cloud security experience including Shield, CloudFront and comprehensive security service management. Expert-level web application penetration testing, including complex business logic vulnerabilities and multi-tier architectures. Proven leadership in vulnerability scoring and risk assessment using industry-standard frameworks. Hands-on expertise with govulncheck, Gitleaks, Semgrep/OpenGrep, Prowler and ScoutSuite. Strong experience securing Node.js applications and modern JavaScript frameworks (Vue.js, ReactJS). Experience leading security teams and influencing organisational security strategy. Technical Skills Expert AWS security services: Shield, CloudFront, GuardDuty, Security Hub, WAF and the wider portfolio. Advanced application security across GoLang, Java, Scala, Node.js, Vue.js and ReactJS. Mastery of security automation tools: govulncheck, Gitleaks, Semgrep/OpenGrep, Prowler, ScoutSuite. Knowledge of CVSS v3.1, OWASP Risk Rating and FAIR methodology. Advanced Infrastructure as Code (Terraform, CloudFormation, AWS CDK). Expert container and orchestration security (Docker, Kubernetes/EKS, service mesh). Advanced scripting and automation (Python, Bash, PowerShell, Go); enterprise network and cloud networking security. Security Expertise Deep understanding of application security principles and advanced penetration testing methodologies. Expert knowledge of cloud security frameworks (NIST, CSA, AWS Well-Architected Security Pillar). Understanding of financial services security and payment processing compliance requirements. Security architecture design for complex distributed systems; advanced threat modeling and risk assessment. Comprehensive knowledge of cryptography, PKI and secure communication protocols. Expert incident response and forensic analysis; understanding of regulatory frameworks and audit requirements. Certifications Required: AWS Security Specialty certification. Preferred: OSCP, GWEB, eWPT or eWPTX; CISSP or CISM; AWS Solutions Architect Professional or DevOps Engineer Professional; Azure or GCP security certifications. Nice to Have Multi-cloud and hybrid security architecture experience. Advanced serverless security knowledge (AWS Lambda, API Gateway, serverless frameworks). Security orchestration and automated response (SOAR) platforms. Machine learning/AI security applications and threat detection. Advanced understanding of payment processing security and financial services infrastructure. Experience with regulatory examinations and security audit leadership. Knowledge of emerging security technologies and threat landscape evolution. Security product evaluation and vendor management experience. Advanced presentation and executive communication skills. Key Abilities and Traits Technical Excellence: Architect and implement comprehensive security solutions across complex application and cloud environments processing sensitive financial data. Leadership: Lead security initiatives across multiple teams, influence strategic decisions, and represent security needs to executive leadership. Strategic Thinking: Balance immediate security needs with long-term objectives, translating business requirements into technical security solutions. Problem-Solving: Address complex security challenges spanning application code to cloud infrastructure. Communication: Explain complex security concepts clearly to technical teams, business stakeholders and executives. Continuous Innovation: Stay current with emerging threats, technologies and best practices while driving security innovation. Project Management: Manage multiple