Senior Security Engineer

Role summary

Testmu AI runs a global cloud testing platform: thousands of real devices, browser VMs and CI pipelines serving engineering teams worldwide. We are hiring a hands-on Senior Security Engineer to own security across our cloud (AWS, Azure), on-prem device farms, corporate IT (Google Workspace) and the edge (Cloudflare/WAF). This is a builder role, not an advisory one. You will stand up our SIEM from scratch, wire security into CI/CD, run continuous external scanning, lead VAPT, and run our bug bounty program. You work both sides: red team (attack our platform, run VAPT and bug bounty) and blue team (build detection, respond to incidents, harden everything). You bring an attacker's mindset and a security-first approach to every system you touch.
##

## What you'll do
Blue team: detection & response (SIEM from scratch)
- Design, deploy and operate our SIEM end to end: log sources, ingestion pipelines, parsing, retention, detection rules, alert routing and dashboards.
- Onboard logs from AWS (CloudTrail, GuardDuty, VPC Flow), Azure (Activity, Defender), Cloudflare, Google Workspace, Linux/Windows endpoints, firewalls and Kubernetes.
- Write and tune detection rules mapped to MITRE ATT&CK; drive alert noise down and signal up.
- Own incident response: triage, containment, root cause, post-incident reviews and runbooks.
Cloud & infrastructure security (AWS, Azure, on-prem)
- Harden AWS and Azure accounts: IAM least privilege, SCPs/Azure Policy, network segmentation, KMS, secrets management, CSPM findings to closure.
- Secure on-prem device farms and data-centre infrastructure: Linux and Windows hardening (CIS benchmarks), patching cadence, EDR coverage, privileged access.
- Manage firewall policy and change control; review and tighten rules across cloud security groups and on-prem firewalls.
- Own Cloudflare: WAF rulesets, rate limiting, bot management, DDoS posture, DNS and TLS hygiene.
Corporate & identity security (Google Workspace)
- Administer Google Workspace security: SSO/SAML, MFA enforcement, OAuth app allow-listing, DLP, device policies, email authentication (SPF/DKIM/DMARC).
- Run joiner-mover-leaver access reviews and identity audits across SaaS.
Pipeline & application security
- Build security into CI/CD: SAST, DAST, SCA, secrets scanning, container and IaC scanning (Trivy, Semgrep, Gitleaks, Checkov or equivalent) with sane fail gates.
- Set up continuous public-facing scanning of our attack surface: asset discovery, exposed ports/services, certificate and DNS monitoring, misconfiguration alerts.
- Review architecture and code for security-sensitive changes; partner with engineering on fixes rather than throwing reports over the wall.
Red team: VAPT, bug bounty & adversary simulation
- Plan and execute internal VAPT on web apps, APIs, mobile, cloud and network; coordinate external pentests and drive remediation to closure.
- Run the LambdaTest bug bounty program: scope, triage, severity rating (CVSS), researcher communication, payout recommendations, fix verification and duplicate handling.
- Hunt on our own platform the way an external researcher would; reproduce and weaponise findings to prove impact.
- Run purple-team exercises: emulate real attacker techniques (MITRE ATT&CK) against production-like environments, then confirm the SIEM detects them and close the gaps it misses.
Compliance & governance
- Own technical controls and evidence for SOC 2 Type II and ISO 27001; support customer security questionnaires and audits.
- Maintain security SOPs, baselines and runbooks; measure and report security posture to leadership.

Must-have skills and experience

- 5–8 years in security engineering with at least 3 years hands-on in a production cloud environment.
- Deployed or substantially rebuilt a SIEM (Wazuh, Elastic Security, Splunk, Microsoft Sentinel, Google SecOps or similar) including log onboarding and detection engineering.
- Deep AWS security (IAM, VPC, GuardDuty, Security Hub, KMS, Organizations) and working Azure security (Entra ID, Defender for Cloud, NSGs, Azure Policy).
- Strong Linux administration and hardening; competent Windows and Active Directory/Entra security.
- Hands-on firewall management (Palo Alto, Fortinet, pfSense/OPNsense or cloud-native) and network security fundamentals.
- Cloudflare or equivalent WAF/CDN: rule authoring, rate limiting, bot mitigation, incident tuning.
- Google Workspace security administration.
- Built DevSecOps pipelines: SAST/DAST/SCA/secrets/IaC scanning integrated into GitHub Actions, GitLab CI or Jenkins.
- Proven VAPT skill: web, API and cloud testing with Burp Suite, Nuclei, Nmap, Metasploit and manual methodology (OWASP Top 10, ASVS, PTES).
- Bug bounty track record on HackerOne, Bugcrowd, Intigriti or equivalent, as a hunter or triager, with reportable valid findings.
- Demonstrated experience on both red team (offensive testing, adversary emulation) and blue team (detection engineering, incident response, hardening); you can run a purple-team exercise end to end.
- Scripting in Python or Bash, plus Git; comfortable with Docker and Kubernetes security basics.
- Clear written communication: findings, runbooks and risk explanations that engineers and executives both understand.

Nice-to-have

- Certifications: OSCP, OSWE, CRTP, AWS Security Specialty, AZ-500, GCIH/GCIA or CISSP.
- Experience securing large device fleets (Android, iOS, macOS) or bare-metal data-centre environments.
- Kubernetes security depth: admission control, runtime detection (Falco), network policies, supply-chain signing.
- Threat modelling and secure design review for multi-tenant SaaS platforms.
- Published CVEs, conference talks, open-source security tooling or public write-ups.
- Experience with SOAR or automating response playbooks.
- Familiarity with GDPR, ISO 27701 or customer-facing security questionnaires (CAIQ, SIG).

Who you are

- Security-first, by default. You treat every design, deploy and access request as a security decision. You push for secure defaults up front instead of bolting on controls after an incident.
- Hands-on. You would rather fix the IAM policy, write the detection rule or reproduce the exploit yourself than file a ticket and wait.
- Attacker's mindset. You think about how systems break, chain small weaknesses into real impact, and prove it rather than theorise.
- Pragmatic. You rank risk by real exploitability and business impact, ship controls that engineers will actually keep, and know when a compensating control beats a perfect one.
- Builder and owner. You are comfortable starting from zero, with no SIEM, no pipeline gates and no bounty program, and turning that into a running system with metrics.
- Clear communicator. You write findings engineers can act on and risk summaries leadership can decide on.
- Calm under incident. You lead triage without drama, document as you go, and turn every incident into a detection or control improvement.

## First 90 days
By Outcome Day 30 Attack-surface inventory complete (cloud accounts, on-prem, SaaS, public assets). Continuous external scanning live with alerting. SIEM platform selected with a costed design signed off. Day 60 SIEM ingesting AWS, Cloudflare, Google Workspace and endpoint logs with the first 20 high-value detections. Secrets, SCA and IaC scanning gating CI on core repositories. Bug bounty triage SLA defined and met. Day 90 SIEM covering Azure, firewalls and Kubernetes with on-call alert routing. First internal VAPT cycle delivered with critical and high findings remediated. Cloudflare WAF baseline rolled out to all public properties. Security posture dashboard reported to leadership.
## Interview process

- Recruiter screen (30 min): background, motivation, logistics.
- Technical deep-dive with hiring manager (60 min): walk through a SIEM you built, a pipeline you secured and a bounty or VAPT finding you are proud of.
- Hands-on assessment (take-home or live, 2–3 hours): a scoped target with cloud misconfigurations and a vulnerable web app; we score methodology, findings and the quality of the write-up.
- Architecture and incident panel (60 min): threat-model a multi-tenant device-farm platform and run a live incident tabletop.
- Leadership conversation (30 min): ownership, communication and culture fit.
To apply: send your CV plus links to any bounty profiles, CVEs, write-ups or open-source work to the hiring team. A short note on the most interesting vulnerability you have found counts more than a cover letter.