Cloud Security & DevSecOps Lead

Our Culture: The “Real” Deal

We don’t just build software; we build careers through our Employee Value Proposition (EVP):

• Real Growth: Learning is integral to delivery. We provide clear pathways and role-based upskilling and certifications.
• Real Care: energytec elevate (e²): 3 hours of protected in-work learning time each week to enable sustainable high performance, continuous development, and long-term career growth; we value sustainable impact over burnout.
• Real Impact: Turn your learning into a legacy. Work with Practice Champions to strengthen our platform architecture and reduce dependencies.

Job Description

Lead - Cloud Security & DevSecOps

About the Role

We are looking for a Lead – Cloud Security & DevSecOps to own the security posture of our AWS cloud platform and CI/CD pipelines, while supporting, designing, and implementing scalable, secure, and reliable infrastructure and DevOps practices. You will lead vulnerability management, drive remediation of AWS Security Hub and Inspector findings, embed security into GitLab CI/CD, and leverage AI-driven insights for proactive monitoring and operational efficiency.

AI-first engineering at energytec.ai

At energytec.ai (eTEC), we build with an AI-first mindset, operating as a human-led, agent-operated organization where engineers own outcomes and use AI responsibly to accelerate delivery, improve quality, and strengthen platform resilience.

• Apply AI across Operations & Security: Utilize AI-driven tools for predictive alerts, intelligent log analysis, threat and anomaly detection, automated incident resolution, and risk-based vulnerability prioritization.
• Guardrails & Governance: Maintain non-negotiable guardrails for security, code reviews, and infrastructure compliance while monitoring reliability through SLOs, DORA metrics, and system performance.
• Knowledge Sharing: Actively share knowledge and standardize prompts, playbooks, and reusable automation scripts to multiply overall team effectiveness.

Responsibilities

• Cloud security posture: Own and continuously improve the AWS security posture across accounts, VPCs, IAM, KMS, Secrets Manager, WAF, CloudTrail and Control Tower.
• Vulnerability management and reporting: Be accountable for the end-to-end vulnerability management lifecycle: discovery, risk-based prioritisation, remediation, verification and reporting. Triage and drive closure of AWS Security Hub and Amazon Guard Duty findings (EC2, ECR, Lambda) against agreed SLAs, coordinating remediation with application and platform teams. Run security reviews covering remediation SLAs, exposure reduction and compliance metrics for leadership and audit readiness.
• Governance, guardrails and compliance: Define, implement and monitor preventative guardrails, Service Control Policies (SCPs) and AWS Config conformance packs across all accounts, ensuring cloud infrastructure and pipelines align with CIS benchmarks and the NIST framework, and support audits. Own the security exception and risk-acceptance workflow, ensuring every suppression or unpatched finding has a documented business rationale, compensating controls and an expiry date.
• DevSecOps pipelines: Integrate and maintain security checks in GitLab CI/CD, including SAST, DAST, SCA, secret detection, container image scanning and IaC scanning, with quality gates and policy-as-code (shift-left).
• Container and workload hardening: Harden and secure workloads on ECS, EKS and RDS, covering hardened container image baselines (CIS), RBAC, network policies and end-to-end encryption.
• Secure Infrastructure as Code and automation: Review and enforce secure Terraform practices, and automate security controls and routine operational tasks.
• Threat detection and incident response: Build and operate AI-driven threat detection that triages alerts and raises actionable GitLab issues, and lead security incident response from containment through to root cause analysis and post-incident actions. Troubleshoot application and infrastructure issues across ECS, EKS, RDS, EC2, networking and CI/CD.
• Leadership and standards: Mentor DevOps and systems engineers, define security standards and runbooks, conduct security reviews of new architectures and releases, and champion DevSecOps practices across the organisation.

Minimum Qualifications

• Core experience: 8+ years of hands-on experience in DevOps, cloud infrastructure or security engineering, with significant AWS cloud security exposure.
• AWS cloud security: Strong hands-on expertise with AWS Security Hub, Amazon Inspector, GuardDuty, IAM, KMS, CloudTrail, Config and WAF.
• DevSecOps: Proven experience securing GitLab CI/CD pipelines and integrating vulnerability scanning and automated security gates into deployment pipelines.
• Vulnerability management: Practical experience with vulnerability management tooling, processes and remediation tracking.
• Containers and cloud workloads: Solid track record securing and operating ECS, EKS/Kubernetes and RDS, including security hardening of each.
• Infrastructure as Code and scripting: Strong practical experience with Terraform and automation scripting in Python or Bash.
• Troubleshooting and observability: Strong application and infrastructure troubleshooting and root cause analysis skills, with hands-on experience of Prometheus, Grafana, CloudWatch, OpenTelemetry or equivalent.
• Leadership and communication: Track record of leading and mentoring engineers, with strong written and verbal communication skills to influence cross-functional teams and present to stakeholders.

Good to have

• Certifications: AWS Certified Security - Specialty, AWS Solutions Architect, CKA/CKS or equivalent.
• AI in DevSecOps: Prior hands-on experience applying AI/ML tools to security or operations work.
• Security tooling: Experience with Trivy, SonarQube, Snyk, Checkov, OPA/Kyverno or similar, and with SIEM and centralized logging.
• Agile delivery: Experience working in Agile teams to ship infrastructure and security improvements every sprint.

Work Location: Hyderabad (ECIL X Roads)

Work Mode: Work from Office (5 days a week)

Notice Period: Looking for candidates who can join within 15 days