Principal Security Engineer Job Summary This role sits at the intersection of cloud-native engineering and security, operating across AWS in a data-intensive, high-throughput payments environment. You will drive deep architecture, engineering, and automation across Cloud Infrastructure and Product Engineering teams — owning security architecture, security engineering, and the security observability layer. You will actively partner across product and infrastructure layers to uplift the cyber resilience of Tazapay's platform, while product-managing security tooling and building security observability capabilities on top of internal product offerings. This is a hands-on, high-ownership role that demands equal parts technical depth and cross-functional leadership. Location: Bangalore Reporting To: CISO Key Responsibilities Architecture • Actively participate in and contribute to the Architecture Review, providing security-informed, opinionated guidance on technology choices across software engineering and infrastructure patterns. • Author and champion RFC-style technical documents, architectural decision records (ADRs), and implementation guides for adoption by product and infrastructure engineering teams. • Shape Tazapay's API strategy with strong ownership over Security, Privacy, and Governance pillars — including API authentication standards, rate limiting, and threat modeling for API surfaces. • Collaborate closely with architecture, product management, product engineering, and GRC teams in a hands-on environment to design, build, and operate products securely. • Work independently with developers, system engineers, and product managers to ensure security and privacy-first design and development reviews across all product and infrastructure initiatives. • Own and maintain a living security design mandate — documenting architectural standards, security controls, and implementation patterns — and drive adoption across product and infrastructure groups. • Independently research, evaluate, and prototype emerging security technologies; develop proof-of-concepts and present findings to the broader engineering community to accelerate informed adoption. • Design and develop enterprise IAM architecture aligned with business and security objectives, including authentication and authorization frameworks using SAML, OAuth 2.0, OpenID Connect, LDAP, and Kerberos. • Lead the implementation and integration of IAM solutions across enterprise applications, cloud platforms, and infrastructure. • Own threat modeling as a structured practice across product and infrastructure — embedding it early in the SDLC and establishing repeatable threat modeling frameworks for engineering teams. • Design and evolve a Zero Trust architecture across Tazapay's multi-cloud environment — spanning network access, identity verification, device trust, and micro-segmentation. Engineering and Automation • Build security automation tooling with a developer-first lens — prioritizing self-serviceability, low friction, and high developer empathy as foundational design principles. • Partner with DevOps and Infrastructure teams to embed security verification gates — including SAST, SCA, secrets scanning, container scanning, and IaC policy checks — natively into CI/CD pipelines. • Own the product management, engineering, and operations of security tooling spanning CI/CD, product, infrastructure, identity, user endpoint, and SaaS partner layers. • Own the product management, engineering, and operations of security monitoring capabilities across the edge — encompassing both Layer 7 (WAF, API gateway, bot protection) and Layer 4 (DDoS, network-level) security controls. • Lead detection engineering efforts to continuously tune, enrich, and improve alert fidelity across the detection and response layer — reducing false positives and improving mean time to detect (MTTD) across infrastructure and product layers. • Drive security control parity and tooling consolidation across all merged and acquired entities, ensuring unified threat management coverage and consistent security posture. • Define and own the vulnerability management program — covering triage, SLA enforcement, prioritization frameworks, and remediation tracking across infrastructure and application layers. • Govern secrets and key management practices across the organization — including PKI, certificate lifecycle, cryptographic standards, and secrets management tooling such as HashiCorp Vault or AWS Secrets Manager. • Own software supply chain security — including SBOM generation, dependency risk assessment, and third-party library governance — to mitigate supply chain attack vectors. Operations Management • Own security operations budget governance — tracking approved spend, run rate, and unit economics — and drive cost optimization without compromising coverage or operational effectiveness. • Manage relationships with managed security service providers (MSSPs) and vendors, holding them accountable to SLA adherence, service quality benchmarks, and continuous improvement commitments. • Define and own incident response playbooks, coordinate with the SIRT during active incidents, and lead post-incident reviews to drive systemic improvements. • Define and track security engineering KPIs — including mean time to remediate (MTTR), vulnerability aging, pipeline gate pass/fail rates, and detection coverage — and present findings to IT leadership and executive stakeholders. Automation and Tooling • Lead automation initiatives across Security and GRC functions to streamline compliance reporting, evidence collection, dashboarding, and audit workflows — materially reducing audit fatigue. • Lead automation initiatives to reduce manual effort in vulnerability management, including automated scanning, triage, ticketing integration, and SLA tracking. • Drive adoption of policy-as-code and automated configuration verification across AWS Culture and Enablement • Champion adoption of Agile practices within the Security team, embedding sprint-based delivery, backlog management, and continuous improvement ceremonies. • Build a product mindset within all members of the security team — encouraging ownership, metrics-driven thinking, and user empathy. • Mentor and coach security engineers on architecture mindset, secure design principles, and career progression pathways. • Foster a Security and Privacy by Design culture within product engineering — embedding shift-left security practices, threat modeling early in the SDLC, and making security a shared engineering responsibility. • Design and deliver a structured developer security awareness program covering secure coding practices, OWASP Top 10, common vulnerability patterns, and threat modeling techniques. Customer Engagement and Compliance • Represent Tazapay's security posture in customer-facing engagements, articulating security maturity, control effectiveness, and tooling adoption with clarity and confidence. • Lead security capability walkthroughs and evidence presentations during internal and external audits including ISO 27001, SOC 1/2, and PCI-DSS assessments, as well as enterprise customer security evaluations. • Architect and maintain regulatory compliance controls aligned to PCI-DSS, ISO 27001, and applicable data protection regulations — ensuring controls are engineering-driven and continuously validated rather than point-in-time. Must Have Requirements • 123+ years of progressive experience as a security architect, product security engineer, or full-stack software engineer, with deep domain ownership in security within cloud-native, data-intensive environments. • Proven experience as a security architect or product security engineer, with strong software engineering fundamentals — preferably in Golang, Java or equivalent — and deep working knowledge of information security principles and secure development practices. • Operational knowledge of cloud service offerings across AWS, GCP, or Azure with focus on securing environments at design, deployment, and runtime layers. • Deep understanding of CI/CD and DevOps practices, with hands-on experience in release management, branching strategy, pipeline governance, and embedding security checkpoints across the engineering lifecycle. • Deep understanding of web applications, data architecture, and microservice architecture — including REST and GraphQL API security. • Experience in microservices adoption and transformation, and building engineering governance models with a focus on API security. • Strong command of application security best practices and design principles including OWASP Top 10, Secure SDLC, and threat modeling methodologies. • Knowledge of common security implementations across authentication, authorization, database security, network security, encryption, logging and monitoring, error handling, and gateway products. • Hands-on experience with IAM architecture and protocols including SAML, OAuth 2.0, OpenID Connect, LDAP, and Kerberos. • Exceptional communication skills — written and verbal — with the ability to translate complex technical security risks into clear, business-aligned, risk-based narratives for engineering, product, and executive audiences. • Proven experience coaching and mentoring security engineers, and operating effectively as a cross-functional team leader. • Experience operating using Agile methodologies and tools including JIRA and Confluence. Nice to Have (Technical) • AWS, GCP, or Azure security certifications (e.g., AWS Security Specialty, Google Professional Cloud Security Engineer, Microsoft SC-100). • Domain experience in payments, banking, or platform-based products — particularly in regulated environments. • Security-specific certifications such as CISSP, CCSP, CSSLP, or CEH. • Experience with observability and SIEM platforms such as Splunk, Datadog, or Chronicle Security. • Familiarity with supply chain security tooling, SBOM generation, and dependency governance frameworks. • Exposure to Zero Trust architecture frameworks and implementation patterns (e.g., BeyondCorp, NIST SP 800-207). • Experience with bug bounty program management or red team/penetration testing program oversight. • Custody, Wallet and Key Management Security - Architect hot, warm, and cold wallet security models — defining signing workflows, quorum policies, key rotation schedules, and hardware security module (HSM) integration. • Architect controls to meet stablecoin-specific regulatory obligations across MAS (Singapore), and applicable jurisdictions. • Define and own incident response playbooks for crypto-native attack scenarios — including smart contract exploits, private key compromise, bridge hacks, oracle attacks, and stablecoin de-pegging events. • Lead post-exploit forensics including on-chain transaction tracing, attacker fund flow tracking, and coordination with exchanges and bridges for asset freezing where possible.