Job Description

Principal Security Engineer


Job Summary

This role sits at the intersection of cloud-native engineering and security, operating across AWS in a data-intensive, high-throughput payments environment. You will drive deep architecture, engineering, and automation across Cloud Infrastructure and Product Engineering teams — owning security architecture, security engineering, and the security observability layer.

You will actively partner across product and infrastructure layers to uplift the cyber resilience of Tazapay's platform, while product-managing security tooling and building security observability capabilities on top of internal product offerings. This is a hands-on, high-ownership role that demands equal parts technical depth and cross-functional leadership.


Location: Bangalore

Reporting To: CISO


Key Responsibilities


Architecture

  • Actively participate in and contribute to the Architecture Review, providing security-informed, opinionated guidance on technology choices across software engineering and infrastructure patterns.

  • Author and champion RFC-style technical documents, architectural decision records (ADRs), and implementation guides for adoption by product and infrastructure engineering teams.

  • Shape Tazapay's API strategy with strong ownership over Security, Privacy, and Governance pillars — including API authentication standards, rate limiting, and threat modeling for API surfaces.

  • Collaborate closely with architecture, product management, product engineering, and GRC teams in a hands-on environment to design, build, and operate products securely.

  • Work independently with developers, system engineers, and product managers to ensure security and privacy-first design and development reviews across all product and infrastructure initiatives.

  • Own and maintain a living security design mandate — documenting architectural standards, security controls, and implementation patterns — and drive adoption across product and infrastructure groups.

  • Independently research, evaluate, and prototype emerging security technologies; develop proof-of-concepts and present findings to the broader engineering community to accelerate informed adoption.

  • Design and develop enterprise IAM architecture aligned with business and security objectives, including authentication and authorization frameworks using SAML, OAuth 2.0, OpenID Connect, LDAP, and Kerberos.

  • Lead the implementation and integration of IAM solutions across enterprise applications, cloud platforms, and infrastructure.

  • Own threat modeling as a structured practice across product and infrastructure — embedding it early in the SDLC and establishing repeatable threat modeling frameworks for engineering teams.

  • Design and evolve a Zero Trust architecture across Tazapay's multi-cloud environment — spanning network access, identity verification, device trust, and micro-segmentation.

Engineering and Automation

  • Build security automation tooling with a developer-first lens — prioritizing self-serviceability, low friction, and high developer empathy as foundational design principles.

  • Partner with DevOps and Infrastructure teams to embed security verification gates — including SAST, SCA, secrets scanning, container scanning, and IaC policy checks — natively into CI/CD pipelines.

  • Own the product management, engineering, and operations of security tooling spanning CI/CD, product, infrastructure, identity, user endpoint, and SaaS partner layers.

  • Own the product management, engineering, and operations of security monitoring capabilities across the edge — encompassing both Layer 7 (WAF, API gateway, bot protection) and Layer 4 (DDoS, network-level) security controls.

  • Lead detection engineering efforts to continuously tune, enrich, and improve alert fidelity across the detection and response layer — reducing false positives and improving mean time to detect (MTTD) across infrastructure and product layers.

  • Drive security control parity and tooling consolidation across all merged and acquired entities, ensuring unified threat management coverage and consistent security posture.

  • Define and own the vulnerability management program — covering triage, SLA enforcement, prioritization frameworks, and remediation tracking across infrastructure and application layers.

  • Govern secrets and key management practices across the organization — including PKI, certificate lifecycle, cryptographic standards, and secrets management tooling such as HashiCorp Vault or AWS Secrets Manager.

  • Own software supply chain security — including SBOM generation, dependency risk assessment, and third-party library governance — to mitigate supply chain attack vectors.

Operations Management

  • Own security operations budget governance — tracking approved spend, run rate, and unit economics — and drive cost optimization without compromising coverage or operational effectiveness.

  • Manage relationships with managed security service providers (MSSPs) and vendors, holding them accountable to SLA adherence, service quality benchmarks, and continuous improvement commitments.

  • Define and own incident response playbooks, coordinate with the SIRT during active incidents, and lead post-incident reviews to drive systemic improvements.

  • Define and track security engineering KPIs — including mean time to remediate (MTTR), vulnerability aging, pipeline gate pass/fail rates, and detection coverage — and present findings to IT leadership and executive stakeholders.

Automation and Tooling

  • Lead automation initiatives across Security and GRC functions to streamline compliance reporting, evidence collection, dashboarding, and audit workflows — materially reducing audit fatigue.

  • Lead automation initiatives to reduce manual effort in vulnerability management, including automated scanning, triage, ticketing integration, and SLA tracking.

  • Drive adoption of policy-as-code and automated configuration verification across AWS

Culture and Enablement

  • Champion adoption of Agile practices within the Security team, embedding sprint-based delivery, backlog management, and continuous improvement ceremonies.

  • Build a product mindset within all members of the security team — encouraging ownership, metrics-driven thinking, and user empathy.

  • Mentor and coach security engineers on architecture mindset, secure design principles, and career progression pathways.

  • Foster a Security and Privacy by Design culture within product engineering — embedding shift-left security practices, threat modeling early in the SDLC, and making security a shared engineering responsibility.

  • Design and deliver a structured developer security awareness program covering secure coding practices, OWASP Top 10, common vulnerability patterns, and threat modeling techniques.

Customer Engagement and Compliance

  • Represent Tazapay's security posture in customer-facing engagements, articulating security maturity, control effectiveness, and tooling adoption with clarity and confidence.

  • Lead security capability walkthroughs and evidence presentations during internal and external audits including ISO 27001, SOC 1/2, and PCI-DSS assessments, as well as enterprise customer security evaluations.

  • Architect and maintain regulatory compliance controls aligned to PCI-DSS, ISO 27001, and applicable data protection regulations — ensuring controls are engineering-driven and continuously validated rather than point-in-time.

Must Have Requirements

  • 123+ years of progressive experience as a security architect, product security engineer, or full-stack software engineer, with deep domain ownership in security within cloud-native, data-intensive environments.

  • Proven experience as a security architect or product security engineer, with strong software engineering fundamentals — preferably in Golang, Java or equivalent — and deep working knowledge of information security principles and secure development practices.

  • Operational knowledge of cloud service offerings across AWS, GCP, or Azure with focus on securing environments at design, deployment, and runtime layers.

  • Deep understanding of CI/CD and DevOps practices, with hands-on experience in release management, branching strategy, pipeline governance, and embedding security checkpoints across the engineering lifecycle.

  • Deep understanding of web applications, data architecture, and microservice architecture — including REST and GraphQL API security.

  • Experience in microservices adoption and transformation, and building engineering governance models with a focus on API security.

  • Strong command of application security best practices and design principles including OWASP Top 10, Secure SDLC, and threat modeling methodologies.

  • Knowledge of common security implementations across authentication, authorization, database security, network security, encryption, logging and monitoring, error handling, and gateway products.

  • Hands-on experience with IAM architecture and protocols including SAML, OAuth 2.0, OpenID Connect, LDAP, and Kerberos.

  • Exceptional communication skills — written and verbal — with the ability to translate complex technical security risks into clear, business-aligned, risk-based narratives for engineering, product, and executive audiences.

  • Proven experience coaching and mentoring security engineers, and operating effectively as a cross-functional team leader.

  • Experience operating using Agile methodologies and tools including JIRA and Confluence.

Nice to Have (Technical)

  • AWS, GCP, or Azure security certifications (e.g., AWS Security Specialty, Google Professional Cloud Security Engineer, Microsoft SC-100).

  • Domain experience in payments, banking, or platform-based products — particularly in regulated environments.

  • Security-specific certifications such as CISSP, CCSP, CSSLP, or CEH.

  • Experience with observability and SIEM platforms such as Splunk, Datadog, or Chronicle Security.

  • Familiarity with supply chain security tooling, SBOM generation, and dependency governance frameworks.

  • Exposure to Zero Trust architecture frameworks and implementation patterns (e.g., BeyondCorp, NIST SP 800-207).

  • Experience with bug bounty program management or red team/penetration testing program oversight.

  • Custody, Wallet and Key Management Security - Architect hot, warm, and cold wallet security models — defining signing workflows, quorum policies, key rotation schedules, and hardware security module (HSM) integration.

  • Architect controls to meet stablecoin-specific regulatory obligations across MAS (Singapore), and applicable jurisdictions.

  • Define and own incident response playbooks for crypto-native attack scenarios — including smart contract exploits, private key compromise, bridge hacks, oracle attacks, and stablecoin de-pegging events.

  • Lead post-exploit forensics including on-chain transaction tracing, attacker fund flow tracking, and coordination with exchanges and bridges for asset freezing where possible.