Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 3 days ago

Senior Security Engineer

LambdaTest7 open roles

Where
Noida
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Security EngineerLambdaTest · Noida

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on LambdaTest's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.4% of postings close within 7 days. Measured by our own scanner across the market. LambdaTest postings stay open a median of 3 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.6%3 days
  3. 13.4%7 days
  4. 21.6%14 days
  5. 36.2%30 days
  6. 59.0%60 days
This job: posted 3 days ago

LambdaTest median: 3 days open

The posting

Role summary

Testmu AI runs a global cloud testing platform: thousands of real devices, browser VMs and CI pipelines serving engineering teams worldwide. We are hiring a hands-on Senior Security Engineer to own security across our cloud (AWS, Azure), on-prem device farms, corporate IT (Google Workspace) and the edge (Cloudflare/WAF).

This is a builder role, not an advisory one. You will stand up our SIEM from scratch, wire security into CI/CD, run continuous external scanning, lead VAPT, and run our bug bounty program. You work both sides: red team (attack our platform, run VAPT and bug bounty) and blue team (build detection, respond to incidents, harden everything). You bring an attacker's mindset and a security-first approach to every system you touch.

What you'll do

Blue team: detection & response (SIEM from scratch)

  • Design, deploy and operate our SIEM end to end: log sources, ingestion pipelines, parsing, retention, detection rules, alert routing and dashboards.
  • Onboard logs from AWS (CloudTrail, GuardDuty, VPC Flow), Azure (Activity, Defender), Cloudflare, Google Workspace, Linux/Windows endpoints, firewalls and Kubernetes.
  • Write and tune detection rules mapped to MITRE ATT&CK; drive alert noise down and signal up.
  • Own incident response: triage, containment, root cause, post-incident reviews and runbooks.

Cloud & infrastructure security (AWS, Azure, on-prem)

  • Harden AWS and Azure accounts: IAM least privilege, SCPs/Azure Policy, network segmentation, KMS, secrets management, CSPM findings to closure.
  • Secure on-prem device farms and data-centre infrastructure: Linux and Windows hardening (CIS benchmarks), patching cadence, EDR coverage, privileged access.
  • Manage firewall policy and change control; review and tighten rules across cloud security groups and on-prem firewalls.
  • Own Cloudflare: WAF rulesets, rate limiting, bot management, DDoS posture, DNS and TLS hygiene.

Corporate & identity security (Google Workspace)

  • Administer Google Workspace security: SSO/SAML, MFA enforcement, OAuth app allow-listing, DLP, device policies, email authentication (SPF/DKIM/DMARC).
  • Run joiner-mover-leaver access reviews and identity audits across SaaS.

Pipeline & application security

  • Build security into CI/CD: SAST, DAST, SCA, secrets scanning, container and IaC scanning (Trivy, Semgrep, Gitleaks, Checkov or equivalent) with sane fail gates.
  • Set up continuous public-facing scanning of our attack surface: asset discovery, exposed ports/services, certificate and DNS monitoring, misconfiguration alerts.
  • Review architecture and code for security-sensitive changes; partner with engineering on fixes rather than throwing reports over the wall.

Red team: VAPT, bug bounty & adversary simulation

  • Plan and execute internal VAPT on web apps, APIs, mobile, cloud and network; coordinate external pentests and drive remediation to closure.
  • Run the LambdaTest bug bounty program: scope, triage, severity rating (CVSS), researcher communication, payout recommendations, fix verification and duplicate handling.
  • Hunt on our own platform the way an external researcher would; reproduce and weaponise findings to prove impact.
  • Run purple-team exercises: emulate real attacker techniques (MITRE ATT&CK) against production-like environments, then confirm the SIEM detects them and close the gaps it misses.

Compliance & governance

  • Own technical controls and evidence for SOC 2 Type II and ISO 27001; support customer security questionnaires and audits.
  • Maintain security SOPs, baselines and runbooks; measure and report security posture to leadership.

Must-have skills and experience

  • 5–8 years in security engineering with at least 3 years hands-on in a production cloud environment.
  • Deployed or substantially rebuilt a SIEM (Wazuh, Elastic Security, Splunk, Microsoft Sentinel, Google SecOps or similar) including log onboarding and detection engineering.
  • Deep AWS security (IAM, VPC, GuardDuty, Security Hub, KMS, Organizations) and working Azure security (Entra ID, Defender for Cloud, NSGs, Azure Policy).
  • Strong Linux administration and hardening; competent Windows and Active Directory/Entra security.
  • Hands-on firewall management (Palo Alto, Fortinet, pfSense/OPNsense or cloud-native) and network security fundamentals.
  • Cloudflare or equivalent WAF/CDN: rule authoring, rate limiting, bot mitigation, incident tuning.
  • Google Workspace security administration.
  • Built DevSecOps pipelines: SAST/DAST/SCA/secrets/IaC scanning integrated into GitHub Actions, GitLab CI or Jenkins.
  • Proven VAPT skill: web, API and cloud testing with Burp Suite, Nuclei, Nmap, Metasploit and manual methodology (OWASP Top 10, ASVS, PTES).
  • Bug bounty track record on HackerOne, Bugcrowd, Intigriti or equivalent, as a hunter or triager, with reportable valid findings.
  • Demonstrated experience on both red team (offensive testing, adversary emulation) and blue team (detection engineering, incident response, hardening); you can run a purple-team exercise end to end.
  • Scripting in Python or Bash, plus Git; comfortable with Docker and Kubernetes security basics.
  • Clear written communication: findings, runbooks and risk explanations that engineers and executives both understand.

Nice-to-have

  • Certifications: OSCP, OSWE, CRTP, AWS Security Specialty, AZ-500, GCIH/GCIA or CISSP.
  • Experience securing large device fleets (Android, iOS, macOS) or bare-metal data-centre environments.
  • Kubernetes security depth: admission control, runtime detection (Falco), network policies, supply-chain signing.
  • Threat modelling and secure design review for multi-tenant SaaS platforms.
  • Published CVEs, conference talks, open-source security tooling or public write-ups.
  • Experience with SOAR or automating response playbooks.
  • Familiarity with GDPR, ISO 27701 or customer-facing security questionnaires (CAIQ, SIG).

Who you are

  • Security-first, by default. You treat every design, deploy and access request as a security decision. You push for secure defaults up front instead of bolting on controls after an incident.
  • Hands-on. You would rather fix the IAM policy, write the detection rule or reproduce the exploit yourself than file a ticket and wait.
  • Attacker's mindset. You think about how systems break, chain small weaknesses into real impact, and prove it rather than theorise.
  • Pragmatic. You rank risk by real exploitability and business impact, ship controls that engineers will actually keep, and know when a compensating control beats a perfect one.
  • Builder and owner. You are comfortable starting from zero, with no SIEM, no pipeline gates and no bounty program, and turning that into a running system with metrics.
  • Clear communicator. You write findings engineers can act on and risk summaries leadership can decide on.
  • Calm under incident. You lead triage without drama, document as you go, and turn every incident into a detection or control improvement.

First 90 days

By

Outcome

Day 30

Attack-surface inventory complete (cloud accounts, on-prem, SaaS, public assets). Continuous external scanning live with alerting. SIEM platform selected with a costed design signed off.

Day 60

SIEM ingesting AWS, Cloudflare, Google Workspace and endpoint logs with the first 20 high-value detections. Secrets, SCA and IaC scanning gating CI on core repositories. Bug bounty triage SLA defined and met.

Day 90

SIEM covering Azure, firewalls and Kubernetes with on-call alert routing. First internal VAPT cycle delivered with critical and high findings remediated. Cloudflare WAF baseline rolled out to all public properties. Security posture dashboard reported to leadership.

Interview process

  1. Recruiter screen (30 min): background, motivation, logistics.
  2. Technical deep-dive with hiring manager (60 min): walk through a SIEM you built, a pipeline you secured and a bounty or VAPT finding you are proud of.
  3. Hands-on assessment (take-home or live, 2–3 hours): a scoped target with cloud misconfigurations and a vulnerable web app; we score methodology, findings and the quality of the write-up.
  4. Architecture and incident panel (60 min): threat-model a multi-tenant device-farm platform and run a live incident tabletop.
  5. Leadership conversation (30 min): ownership, communication and culture fit.

To apply: send your CV plus links to any bounty profiles, CVEs, write-ups or open-source work to the hiring team. A short note on the most interesting vulnerability you have found counts more than a cover letter.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against LambdaTest's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on LambdaTest's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    LambdaTest's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.