Cloud Security Consultant - Delhi

Payatu is looking for a hands-on Cloud Security & CI/CD Security Consultant who goes beyond identifying security issues to driving them to closure, securing cloud environments, hardening CI/CD pipelines, detecting exposed secrets, and helping engineering teams build security into their development workflows. Who we are? We are a service-based cybersecurity company, and pentesting is what we do all day, every day, across Web Apps, Mobile Apps, Cloud Security, and Thick Clients. Our reputation is built on catching what automated scanners walk right past: business logic flaws and application-specific vulnerabilities that only show up when someone sits down and thinks like an attacker instead of running through a checklist. What we look for outside work parameters? Your expertise is your primary qualification, not your degree or certification. Your publicly known contributions are your credentials. Papers you have written and tools you have developed are your references. Your write-up reflects your interests and ethics. Your published exploits, CTF scores, and Hall of Fame listings are testimonies of your work. Your research papers have been published or presented at conferences. You are learning from the community and enthusiastically contributing back. Relevant cloud security, DevSecOps, and container security certifications are a plus, but we don't gatekeep on degrees or certifications. Bonus points for AI security skills, on either side of the fence - attacking AI systems or building smart automation around your own testing. You are a perfect technical fit if: You have hands-on experience securing cloud environments across AWS, Azure, or GCP, preferably AWS. You can operate and tune cloud security posture management (CSPM/CNAPP) tools to identify, prioritize, and remediate cloud security risks. You understand how to investigate hardcoded secrets in source-code repositories and drive credential remediation end to end. You can secure CI/CD pipelines against credential leakage, unauthorized access, pipeline tampering, and software supply-chain attacks. You can review Terraform, CloudFormation, and other Infrastructure-as-Code (IaC) configurations to identify and remediate security misconfigurations. You understand both security within the pipeline and the security of the pipeline itself. You can translate security findings into clear, actionable remediation guidance for engineering, DevOps, and architecture teams. You can automate security operations and improve detection coverage instead of relying entirely on manual triage. You can own the complete lifecycle of security findings, from detection and validation through remediation, SLA tracking, escalation, and closure. How the everyday work looks like: Deploy, configure, tune, and operate cloud security posture management tools such as Wiz, Prisma Cloud, Orca Security, AWS Security Hub, or equivalent platforms across cloud environments. Monitor cloud environments for security misconfigurations, excessive permissions, configuration drift, non-compliant resources, and potential attack paths. Triage security findings, validate alerts, reduce false positives, prioritize risks, and coordinate remediation with engineering and infrastructure teams. Investigate hardcoded API keys, passwords, tokens, and other exposed credentials across source-code repositories. Guide engineering teams through credential revocation, rotation, vault migration, and Git commit-history cleanup, and verify remediation. Identify gaps in secrets detection coverage and improve detection logic to identify exposed credentials and insecure repository practices. Assess and harden CI/CD pipelines against credential leakage, unauthorized access, pipeline tampering, privilege escalation, and software supply-chain attacks. Review how secrets are stored, injected, and consumed within pipeline workflows and recommend secure alternatives. Evaluate pipeline security controls, including branch protection, access permissions, approval gates, deployment environment isolation, and security scanning. Improve the integration of code scanning, dependency scanning, IaC scanning, container image scanning, and policy checks into CI/CD workflows using tools such as Jenkins, GitHub Actions, GitLab CI/CD, or Azure DevOps. Review Terraform, CloudFormation, and other Infrastructure-as-Code configurations to identify security weaknesses and provide actionable remediation guidance. Apply secure configuration principles across cloud environments, including IAM, least privilege access, and cloud networking. Automate security triage, detection, remediation, and reporting using Python, Bash, PowerShell, or similar scripting technologies. Own the end-to-end lifecycle of security findings, from detection and validation through remediation, SLA tracking, escalation, and closure. Track remediation timelines, monitor ageing findings, escalate high-risk and overdue issues, and verify closure with the respective owners. Prepare operational dashboards and reports covering finding volumes, remediation rates, SLA adherence, recurring issues, and security trends. Develop and maintain runbooks, triage playbooks, standard operating procedures, detection logic documentation, and internal knowledge-base articles. Collaborate with cloud engineering, DevOps, and architecture teams to improve security controls, resolve findings, and integrate security into development workflows. Identify recurring security gaps and recommend improvements to detection capabilities, tooling, automation, and operational processes. Experience: 3-6 years of hands-on experience in Cloud Security Operations, DevSecOps, CI/CD Security, or a closely related security engineering role, with practical exposure to cloud security and preferably AWS. Good to Have: Relevant cloud security, DevSecOps, or container security certifications. Experience with tools such as Checkov, tfsec, Trivy, Semgrep, Snyk, or equivalent security scanning platforms. Familiarity with policy-as-code, detection-as-code, and automated security enforcement. Experience with IT service management and ticketing platforms for security finding lifecycle management. Experience working in enterprise-scale or globally distributed environments. Familiarity with Agile delivery practices and sprint-based work management. Experience supporting compliance audits, security evidence collection, and remediation reporting.