Senior DevSecOps Engineer Security and Compliance

About the role
Company builds IIoT SaaS products (True Connect, True Factory, True Calibration) running on AWS for enterprise customers. You will own the security posture of this platform and lead it through SOC 2 Type 1 and Type 2 audits, CSA CAIQ Lite, and remediation of our AWS Well-Architected Framework (WAF) security and reliability findings. This is a hands-on senior role: you design the controls, build them in AWS, and produce the evidence auditors need.

What you'll do

• Lead SOC 2 Type 1 readiness and the Type 2 observation period end to end: gap assessment, control design, evidence collection, and working with the audit firm.
• Complete and maintain the CSA CAIQ Lite and answer customer security questionnaires.
• Close AWS Well-Architected security findings: GuardDuty, Security Hub, CloudTrail and Config in every account, root MFA, EBS encryption, S3 public-access blocks, WAF and service-to-service network policies.
• Harden our multi-account AWS setup (EKS, RDS/PostgreSQL, MongoDB, Kafka) with least-privilege IAM, SSO and short-lived credentials.
• Own secrets and key rotation, vulnerability management, patching cadence and container/runtime security (Sysdig).
• Build backup, restore-testing and disaster recovery processes with defined RTO/RPO.
• Write the security incident response plan and run external penetration tests to closure.
• Automate compliance evidence in CI/CD (policy-as-code, IaC scanning) and set up a compliance platform such as Vanta or Drata.
• Mentor the Pune engineering team on secure engineering practices.

Must have

• 1215 years in DevOps, cloud infrastructure or security engineering, with at least 5 years in DevSecOps.
• Has personally taken a SaaS company through SOC 2 Type 1 and Type 2 audits, including the remediation work.
• Hands-on experience completing CSA CAIQ / CAIQ Lite.
• Has run an AWS Well-Architected Framework review and fixed its security and reliability findings.
• Deep AWS security knowledge: IAM, Organizations/Control Tower, GuardDuty, Security Hub, CloudTrail, Config, KMS, Secrets Manager, WAF, VPC design.
• Strong Kubernetes (EKS) and container security; Terraform or similar IaC.
• CI/CD security tooling: SAST, SCA, image scanning, secrets scanning.
• Clear written and spoken English for working with US leadership, auditors and customers.
• Certifications: AWS Certified Security – Specialty, CISSP, CCSP or CKS.

Nice to have

• ISO 27001 or CSA STAR Level 2 experience.
• IoT/IIoT security background (device identity, MQTT, edge gateways).
• Experience with Vanta, Drata or Secureframe.
• Prior experience working with a US-headquartered product company.