CommerceIQ - Security Engineer III

Bengaluru, Karnataka, India1w ago

Requirements

• 6–10 years of experience in information security, cloud security, application security, or DevSecOps. • Strong hands-on experience with AWS and/or GCP security. • Good understanding of IAM, least-privilege access, secrets management, encryption, and network security. • Experience integrating security tools into CI/CD pipelines. • Familiarity with tools such as SonarQube, Snyk, Trivy, Checkov, Wiz, or equivalent. • Working knowledge of Kubernetes, Docker, Terraform, GitHub Actions, Jenkins, or similar technologies. • Knowledge of OWASP Top 10, common application vulnerabilities, and secure coding practices. • Experience with vulnerability management, security incident response, and risk assessment. • Scripting skills in Python, Bash, or similar languages. • Understanding of SOC 2 or ISO 27001 requirements. • Autofill my application

Responsibilities

• Cloud Security: Secure AWS and GCP environments, including IAM, network security, encryption, logging, and access controls. • Application Security: Perform security reviews, vulnerability assessments, penetration testing coordination, and remediation tracking. • DevSecOps: Integrate security scanning into CI/CD pipelines, including SAST, DAST, dependency scanning, container scanning, and IaC scanning. • Infrastructure Security: Secure Kubernetes, Docker, Terraform, Linux systems, and cloud infrastructure. • Security Monitoring: Improve threat detection, security logging, alerting, incident response, and investigation processes. • Vulnerability Management: Identify, prioritize, and remediate vulnerabilities across applications, infrastructure, and dependencies. • Compliance: Support SOC 2, ISO 27001, customer security assessments, audits, and evidence collection. • Security Automation: Build scripts and tools to automate security checks, reporting, and remediation. • Incident Response: Investigate security incidents, perform root-cause analysis, and implement preventive measures. • Cross-functional Collaboration: Partner with Engineering, DevOps, IT, and Product teams to embed security into everyday workflows.