Cloud Security Consultant

Payatu is hiring an Application Security Consultant who's genuinely good at breaking things by hand, not someone who lets a scanner do the thinking. Who we are? We are a service-based cybersecurity company, and pentesting is what we do all day, every day, across Web Apps, Mobile Apps, Cloud security and Thick Clients. Our reputation is built on catching what automated scanners walk right past: business logic flaws and the application-specific bugs that only show up when someone sits down and thinks like an attacker instead of running through a checklist. What we look for outside work parameters? Your expertise is your primary qualification, not your degree or certification. Your publicly known contributions are your credentials. Papers you have written, tools you have developed are your references. Your write-up reflects your interests and ethics. Your published exploits, your CTF scores, and hall of fame listings are the testimonies of your work. Your research paper was published and presented at conferences. You are learning from the community and enthusiastically contributing back. Certifications like OSCP, CREST, OSWE, and similar are a plus if you’ve got them, but we don’t gatekeep on degrees or certifications. Bonus points for AI security skills, on either side of the fence - attacking AI systems or building smart automation around your own testing. You are a perfect technical fit if: Own the security posture of Angel One Wealth's AWS environment. Detect and prevent misconfigurations via CSPM. Build proactive guardrails to block risky changes before they reach production. Operate the XDR solution for cloud threat detection and response. Secure Kubernetes (EKS) workloads. Build-and-operate role implements controls, not just an advisory function. How the everyday work looks like: Deploy, tune and operate a CSPM tool (AWS Security Hub, Wiz, Prisma Cloud, or similar) across all AWS accounts. Continuously monitor for misconfigurations, drift, and non-compliant resources. Triage findings and drive them to closure with application/infra owners. Maintain compliance mapping against internal policy and SEBI CSCRF requirements. Design and implement preventive controls: AWS Organizations SCPs, Config rules, IAM permission boundaries, guardrails-as-code Block or auto-remediate non-compliant resources at creation time, not after the fact Build automated remediation playbooks for common misconfigurations (open security groups, public S3 buckets, unencrypted storage, overly permissive IAM roles) Key Responsibilities - XDR / Threat Detection & Response /Kubernetes coordinate with CrowdStrike team for coverage and policy configuration and coordinate with SOC team ensure logs are received in SIEM solution. Cluster hardening per CIS Benchmarks for Kubernetes Implement pod security standards / admission controls Implement network policies Enforce image scanning and signing in the CI/CD pipeline Manage secrets properly (no hardcoded secrets in manifests) Runtime threat detection for containers Partner with DevOps/platform engineering on security review of infrastructure-as-code (Terraform/CloudFormation) Maintain audit-ready evidence for VAPT, cyber audits, and regulatory reviews Participate in on-call rotation for critical cloud security incidents Support enforcement of the Cyber Resilience, ICS, and IT security policies as they apply to cloud infrastructure Required Skills & Experience: 3-6 years in cloud security or DevSecOps, including 2+ years focused specifically on AWS Hands-on production experience with a CSPM tool (AWS Security Hub/Config, Wiz, Prisma Cloud, Orca, or similar) Experience writing and enforcing AWS guardrails: SCPs, Config rules, IAM policy design, and/or policy-as-code (OPA/Rego, Sentinel) Experience operating an XDR or equivalent platform (CrowdStrike, SentinelOne, Microsoft Defender, Palo Alto Cortex XDR) - tuning and responding, not just consuming alerts Solid working knowledge of Kubernetes security on AWS (EKS): RBAC, network policies, pod security, image scanning Strong understanding of IAM, VPC networking, encryption (KMS), and logging (CloudTrail, VPC Flow Logs, GuardDuty) Comfortable with Infrastructure-as-Code (Terraform and/or CloudFormation) and scripting (Python or Bash) for automation Good to Have: AWS Certified Security - Specialty Certified Kubernetes Security Specialist (CKS) Experience in a SEBI-regulated or other regulated financial services environment Familiarity with SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF)