The posting
About Amartha
Amartha is a technology company focused on creating shared prosperity by developing digital financial solutions for the grassroots economy. Founded in 2010 as a microfinance institution, Amartha connects rural, women-led micro-enterprises with affordable capital. Amartha is expanding as a tech company, building a microfinance ecosystem that connects to the growing digital economy through capital, investment, and payment services. By boosting the competitiveness of micro and small entrepreneurs, Amartha empowers women-led MSMEs, creates jobs, and fosters inclusive economic growth.
Our Empowered to Grow culture guides how we work together. We Focus on Clarity, Take the Lead, and Grow Impact, empowering our people to take ownership and create meaningful, lasting impact.
About the role
Amartha is an Indonesian fintech group that provides financial services to micro-entrepreneurs through several licensed entities in lending, payments, and related services. Our production platform runs on Google Cloud and Kubernetes, and our security team is building the controls, detection, and automation that a regulated lender needs at that scale.
We are looking for a Senior Security Engineer to own cloud and platform security engineering. You will run the controls that detect and prevent misconfiguration and intrusion across our cloud and container estate, respond to what our detection stack surfaces, and turn manual security infrastructure into code. You will work alongside DevOps and platform engineering, and your work feeds directly into our ISO 27001 and regulator audit evidence.
This is a hands-on individual contributor role with a wide mandate. You will be the senior voice on cloud security in the team, and we expect you to set the technical direction for it rather than wait for a backlog.
What you will do
- Own container and cloud runtime security: workload isolation, Kubernetes hardening, and runtime threat detection.
- Run and extend automated benchmark and configuration scanning across our cloud platform and productivity suite, and act on what it finds.
- Build shift-left security into CI/CD: infrastructure-as-code scanning and misconfiguration gates before deployment.
- Bring the security team's own cloud estate under infrastructure as code. Provisioning is manual and drift-prone today, and ending that is a named deliverable of this role.
- Build and run the deployment pipeline for our security tooling, so security infrastructure ships the same way the product does.
- Own the SIEM platform end to end: network isolation, version currency, configuration management, and detection coverage across critical workloads.
- Respond to and review security alerts, tune detection rules, and cut false positives.
- Manage edge and perimeter security: web application firewall rules, DNS and traffic visibility, and security event retention.
- Manage the platform and console access paths that sit with security engineering.
- Document what you build, to the standard where another engineer can operate it without you. Continuity is a measured outcome of this role, not a nice-to-have.
- Share the information security on-call rotation, and help us establish it.
- Produce the control evidence our auditors and regulators ask for, with the GRC team.
What you bring
- 5 or more years in security engineering, infrastructure engineering, or SRE, with at least 3 years focused on cloud and container security.
- Hands-on depth in public cloud and Kubernetes security: identity and access management, RBAC, workload identity, network policy, admission control, runtime detection, and secret management. Google Cloud is our primary platform.
- Production experience with a SIEM, including deployment, detection rule authoring, and alert triage.
- Infrastructure as code in practice, not in theory: reusable modules, state management, and deployment pipelines you built and operated yourself.
- Experience embedding security scanning into CI/CD, such as infrastructure-as-code scanning, static analysis, container image scanning, or policy as code.
- Working knowledge of cloud benchmark and hardening standards, and the judgement to decide which findings matter.
- Scripting and automation in Python, Go, or Bash.
- A documentation habit. We need an engineer who writes runbooks without being asked, because the gap this role fills is as much continuity as it is technical.
- Fluent written and spoken Bahasa Indonesia and English.
Nice to have
- Experience in a regulated financial institution: bank, multifinance company, P2P lending platform, payment provider, or e-money issuer.
- Familiarity with Indonesian regulation on information technology risk and data protection in financial services, in particular POJK 4/2021 and UU PDP.
- Exposure to ISO 27001 control evidence, internal audit, or external certification audits.
- Cloud or Kubernetes security certification: GCP Professional Cloud Security Engineer, CKS, or equivalent.
- Exposure to threat intelligence platforms, vulnerability and finding management, or cloud compliance and posture management.
- Experience building or running an on-call rotation for a security function.
- Multi-cloud exposure, in particular a migration between major cloud providers.
At Amartha, we are dedicated to creating a workplace that celebrates diversity, ensures equity, and fosters inclusion. We believe that diverse perspectives—shaped by factors such as gender, age, race, ethnicity, education, culture, and life experiences—drive innovation and growth.
We actively welcome individuals from all backgrounds to join us in building an environment where everyone feels respected, valued, and empowered. Our commitment is to provide equal opportunities and foster a sense of belonging that enables our employees to thrive and make meaningful contributions.
