Sr Security Engineer

Role summary
What youll do

• Design, deploy and operate our SIEM end to end: log sources, ingestion pipelines, parsing, retention, detection rules, alert routing and dashboards.
• Onboard logs from AWS (CloudTrail, GuardDuty, VPC Flow), Azure (Activity, Defender), Cloudflare, Google Workspace, Linux/Windows endpoints, firewalls and Kubernetes.
• Write and tune detection rules mapped to MITRE ATTCK; drive alert noise down and signal up.
• Own incident response: triage, containment, root cause, post-incident reviews and runbooks.

• Harden AWS and Azure accounts: IAM least privilege, SCPs/Azure Policy, network segmentation, KMS, secrets management, CSPM findings to closure.
• Secure on-prem device farms and data-centre infrastructure: Linux and Windows hardening (CIS benchmarks), patching cadence, EDR coverage, privileged access.
• Manage firewall policy and change control; review and tighten rules across cloud security groups and on-prem firewalls.
• Own Cloudflare: WAF rulesets, rate limiting, bot management, DDoS posture, DNS and TLS hygiene.

• Administer Google Workspace security: SSO/SAML, MFA enforcement, OAuth app allow-listing, DLP, device policies, email authentication (SPF/DKIM/DMARC).
• Run joiner-mover-leaver access reviews and identity audits across SaaS.

• Build security into CI/CD: SAST, DAST, SCA, secrets scanning, container and IaC scanning (Trivy, Semgrep, Gitleaks, Checkov or equivalent) with sane fail gates.
• Set up continuous public-facing scanning of our attack surface: asset discovery, exposed ports/services, certificate and DNS monitoring, misconfiguration alerts.
• Review architecture and code for security-sensitive changes; partner with engineering on fixes rather than throwing reports over the wall.

• Plan and execute internal VAPT on web apps, APIs, mobile, cloud and network; coordinate external pentests and drive remediation to closure.
• Run the LambdaTest bug bounty program: scope, triage, severity rating (CVSS), researcher communication, payout recommendations, fix verification and duplicate handling.
• Hunt on our own platform the way an external researcher would; reproduce and weaponise findings to prove impact.
• Run purple-team exercises: emulate real attacker techniques (MITRE ATTCK) against production-like environments, then confirm the SIEM detects them and close the gaps it misses.

• Own technical controls and evidence for SOC 2 Type II and ISO 27001; support customer security questionnaires and audits.
• Maintain security SOPs, baselines and runbooks; measure and report security posture to leadership.

Must-have skills and experience

• 5-8 years in security engineering with at least 3 years hands-on in a production cloud environment.
• Deployed or substantially rebuilt a SIEM (Wazuh, Elastic Security, Splunk, Microsoft Sentinel, Google SecOps or similar) including log onboarding and detection engineering.
• Deep AWS security (IAM, VPC, GuardDuty, Security Hub, KMS, Organizations) and working Azure security (Entra ID, Defender for Cloud, NSGs, Azure Policy).
• Strong Linux administration and hardening; competent Windows and Active Directory/Entra security.
• Hands-on firewall management (Palo Alto, Fortinet, pfSense/OPNsense or cloud-native) and network security fundamentals.
• Cloudflare or equivalent WAF/CDN: rule authoring, rate limiting, bot mitigation, incident tuning.
• Google Workspace security administration.
• Built DevSecOps pipelines: SAST/DAST/SCA/secrets/IaC scanning integrated into GitHub Actions, GitLab CI or Jenkins.
• Proven VAPT skill: web, API and cloud testing with Burp Suite, Nuclei, Nmap, Metasploit and manual methodology (OWASP Top 10, ASVS, PTES).
• Bug bounty track record on HackerOne, Bugcrowd, Intigriti or equivalent, as a hunter or triager, with reportable valid findings.
• Demonstrated experience on both red team (offensive testing, adversary emulation) and blue team (detection engineering, incident response, hardening); you can run a purple-team exercise end to end.
• Scripting in Python or Bash, plus Git; comfortable with Docker and Kubernetes security basics.
• Clear written communication: findings, runbooks and risk explanations that engineers and executives both understand.

Nice-to-have

• Certifications: OSCP, OSWE, CRTP, AWS Security Specialty, AZ-500, GCIH/GCIA or CISSP.
• Experience securing large device fleets (Android, iOS, macOS) or bare-metal data-centre environments.
• Kubernetes security depth: admission control, runtime detection (Falco), network policies, supply-chain signing.
• Threat modelling and secure design review for multi-tenant SaaS platforms.
• Published CVEs, conference talks, open-source security tooling or public write-ups.
• Experience with SOAR or automating response playbooks.
• Familiarity with GDPR, ISO 27701 or customer-facing security questionnaires (CAIQ, SIG).

Who you are

• Security-first, by default. You treat every design, deploy and access request as a security decision. You push for secure defaults up front instead of bolting on controls after an incident.
• Hands-on. You would rather fix the IAM policy, write the detection rule or reproduce the exploit yourself than file a ticket and wait.
• Attackers mindset. You think about how systems break, chain small weaknesses into real impact, and prove it rather than theorise.
• Pragmatic. You rank risk by real exploitability and business impact, ship controls that engineers will actually keep, and know when a compensating control beats a perfect one.
• Builder and owner. You are comfortable starting from zero, with no SIEM, no pipeline gates and no bounty program, and turning that into a running system with metrics.
• Clear communicator. You write findings engineers can act on and risk summaries leadership can decide on.
• Calm under incident. You lead triage without drama, document as you go, and turn every incident into a detection or control improvement.

First 90 days By Outcome Day 30 Attack-surface inventory complete (cloud accounts, on-prem, SaaS, public assets). Continuous external scanning live with alerting. SIEM platform selected with a costed design signed off. Day 60 SIEM ingesting AWS, Cloudflare, Google Workspace and endpoint logs with the first 20 high-value detections. Secrets, SCA and IaC scanning gating CI on core repositories. Bug bounty triage SLA defined and met. Day 90 SIEM covering Azure, firewalls and Kubernetes with on-call alert routing. First internal VAPT cycle delivered with critical and high findings remediated. Cloudflare WAF baseline rolled out to all public properties. Security posture dashboard reported to leadership. Interview process

1. Recruiter screen (30 min): background, motivation, logistics.
2. Technical deep-dive with hiring manager (60 min): walk through a SIEM you built, a pipeline you secured and a bounty or VAPT finding you are proud of.
3. Hands-on assessment (take-home or live, 2-3 hours): a scoped target with cloud misconfigurations and a vulnerable web app; we score methodology, findings and the quality of the write-up.
4. Architecture and incident panel (60 min): threat-model a multi-tenant device-farm platform and run a live incident tabletop.
5. Leadership conversation (30 min): ownership, communication and culture fit.