SecOps Engineer

💡 Full-time, on-site in Bangalore | Mid to Senior level

About Even At Even, we believe there is a better approach to healthcare - one where everyone is fully covered for all their healthcare needs, focusing on keeping people healthy, not just treating them when they are sick. By managing the clinical care model directly with our dedicated doctors, clinics, and partner network, we are structurally lowering the cost of care while drastically improving the patient experience. We are proving that healthcare can be both higher quality and more affordable. We work closely with top-tier insurers, labs, and hospitals while running our own medical facilities to tightly control healthcare outcomes, costs, and the overall member experience. That philosophy is deeply reflected in our tech team. With a lean team of around 40 people, we have built an incredible ecosystem of systems from scratch: from an in-house EMR platform and a feature-rich consumer app to internal automation platforms and our own custom UPI scanning engine. There is an immense amount of high-impact tech already running at Even, and we are just getting started.

What You Will Do You’ll be our first dedicated security hire. We don't have a rigid legacy security stack for you to maintain - you'll be designing and hardening our defensive architecture from the ground up, fully embedded in a team that ships fast in a Go-heavy monorepo environment.

• Harden our GCP Infrastructure: We run a production environment utilizing managed cloud services across multiple GCP projects (including production, staging, and administrative environments), using VPC-scoped architectures, managed databases, and targeted compute workloads. You will own IAM policies, network security configurations, and service account permissions - ensuring true least-privilege access across the board.
• Secure Secret & Configuration Management: We use cloud secret management systems extensively for API keys, payment infrastructure credentials, encryption keys, and database passwords. You’ll audit secret rotation policies, manage how credentials flow into our containerized services at deploy time, and ensure blast radius containment.
• Lock Down Integration Surfaces: We integrate directly with partner banks, payment processors, insurance platforms, labs, and hospitals. Because each integration handles sensitive financial or medical data, you will assess these integration surfaces, secure traffic, and build robust monitoring for anomalous API behavior.
• Build Security into the CI/CD Pipeline: Our automated builds and deployments move quickly. You will plug in container image scanning, dependency vulnerability checks, and static analysis directly into our build-time pipeline. We prefer proactively blocking vulnerable images from deploying over finding out about them in a post-mortem report.
• Own Incident Detection & Observability: Utilizing our centralized logging, monitoring, and tracing stacks, you will build security-specific alerting patterns (e.g., catching credential misuse or unexpected service-to-service traffic). You should be the person who flags anomalies first and knows exactly how to respond.
• Drive Vulnerability & Culture Management: Coordinate external penetration tests, conduct internal assessments, and sit right alongside backend engineers to prioritize and remediate risks. With a tight-knit engineering team, you won't be writing compliance docs nobody reads; you'll be actively reviewing code changes affecting auth or payments and making the secure path the path of least resistance.

What You Will Need

• 4+ years of experience in SecOps, cloud security, or DevSecOps in a production cloud environment.
• Strong hands-on experience with GCP: Deep familiarity with GCP IAM, VPC architectures, Secret Manager, Cloud Run, and SQL management.
• Automation/Scripting Capabilities: Ability to write tools and security automation in Go, Python, or Bash. Go is our primary language - being able to read and confidently contribute to Go code is a big plus.
• Container Security Expertise: Experience managing image scanning, base image hygiene, and runtime monitoring. We utilize streamlined, containerized workloads on managed cloud platforms rather than heavy orchestration frameworks.
• Practical Experience with Security Tooling: Hands-on experience with tools like Trivy, Falco, SonarQube, OPA, or similar open-source and cloud-native security suites.
• Understanding of Secret Management Patterns: Proven experience handling automated rotation, least-privilege boundaries, and secure injection patterns.

Good to have

• Experience securing healthcare data (PHI) under Indian data protection frameworks, or protecting fintech/payment infrastructure (UPI integrations, PCI-DSS exposure).
• Familiarity with securing AI/ML pipelines and LLM-based systems - we use these internally and recognize their unique attack vectors.
• Active participation in the security community (bug bounties, CTFs, or contributing to open-source security tools).
• Experience with advanced monorepo build tools or modern continuous deployment engines.

Why Even Healthcare?

• Real Impact: You are protecting the sensitive medical histories and financial data of thousands of members, not optimizing ad algorithms.
• Build, Don't Maintain: You get a blank canvas to design our operational security posture, not an inherited corporate compliance checklist.
• Lean Team, Big Surface: With around 40 people across product and tech, the ratio of engineering ownership to platform scale is incredibly high. You will face genuinely fascinating, multi-faceted architectural challenges.
• Engineering-First Culture: We value structured code reviews, build custom tooling when off-the-shelf options fall short, and consistently choose automation over manual documentation.

Ready to make a difference? Apply now and join us on our journey to transform healthcare. Skills: aws,secops,gcp,cloud security,devsecops,iam