Senior Security Engineer

• *Role summary**

================

Testmu AI runs a global cloud testing platform: thousands of real devices, browser VMs and CI pipelines serving engineering teams worldwide. We are hiring a hands\-on Senior Security Engineer to own security across our cloud (AWS, Azure), on\-prem device farms, corporate IT (Google Workspace) and the edge (Cloudflare/WAF).

This is a builder role, not an advisory one. You will stand up our SIEM from scratch, wire security into CI/CD, run continuous external scanning, lead VAPT, and run our bug bounty program. You work both sides: red team (attack our platform, run VAPT and bug bounty) and blue team (build detection, respond to incidents, harden everything). You bring an attacker's mindset and a security\-first approach to every system you touch.**What you'll do**

• -----------------

• *Blue team: detection \& response (SIEM from scratch)*** Design, deploy and operate our SIEM end to end: log sources, ingestion pipelines, parsing, retention, detection rules, alert routing and dashboards.
• Onboard logs from AWS (CloudTrail, GuardDuty, VPC Flow), Azure (Activity, Defender), Cloudflare, Google Workspace, Linux/Windows endpoints, firewalls and Kubernetes.
• Write and tune detection rules mapped to MITRE ATT\&CK; drive alert noise down and signal up.
• Own incident response: triage, containment, root cause, post\-incident reviews and runbooks.

• *Cloud \& infrastructure security (AWS, Azure, on\-prem)*** Harden AWS and Azure accounts: IAM least privilege, SCPs/Azure Policy, network segmentation, KMS, secrets management, CSPM findings to closure.
• Secure on\-prem device farms and data\-centre infrastructure: Linux and Windows hardening (CIS benchmarks), patching cadence, EDR coverage, privileged access.
• Manage firewall policy and change control; review and tighten rules across cloud security groups and on\-prem firewalls.
• Own Cloudflare: WAF rulesets, rate limiting, bot management, DDoS posture, DNS and TLS hygiene.

• *Corporate \& identity security (Google Workspace)*** Administer Google Workspace security: SSO/SAML, MFA enforcement, OAuth app allow\-listing, DLP, device policies, email authentication (SPF/DKIM/DMARC).
• Run joiner\-mover\-leaver access reviews and identity audits across SaaS.

• *Pipeline \& application security*** Build security into CI/CD: SAST, DAST, SCA, secrets scanning, container and IaC scanning (Trivy, Semgrep, Gitleaks, Checkov or equivalent) with sane fail gates.
• Set up continuous public\-facing scanning of our attack surface: asset discovery, exposed ports/services, certificate and DNS monitoring, misconfiguration alerts.
• Review architecture and code for security\-sensitive changes; partner with engineering on fixes rather than throwing reports over the wall.

• *Red team: VAPT, bug bounty \& adversary simulation*** Plan and execute internal VAPT on web apps, APIs, mobile, cloud and network; coordinate external pentests and drive remediation to closure.
• Run the LambdaTest bug bounty program: scope, triage, severity rating (CVSS), researcher communication, payout recommendations, fix verification and duplicate handling.
• Hunt on our own platform the way an external researcher would; reproduce and weaponise findings to prove impact.
• Run purple\-team exercises: emulate real attacker techniques (MITRE ATT\&CK) against production\-like environments, then confirm the SIEM detects them and close the gaps it misses.

• *Compliance \& governance*** Own technical controls and evidence for SOC 2 Type II and ISO 27001; support customer security questionnaires and audits.
• Maintain security SOPs, baselines and runbooks; measure and report security posture to leadership.

• *Must\-have skills and experience**
• -----------------------------------

• 5–8 years in security engineering with at least 3 years hands\-on in a production cloud environment.
• Deployed or substantially rebuilt a SIEM (Wazuh, Elastic Security, Splunk, Microsoft Sentinel, Google SecOps or similar) including log onboarding and detection engineering.
• Deep AWS security (IAM, VPC, GuardDuty, Security Hub, KMS, Organizations) and working Azure security (Entra ID, Defender for Cloud, NSGs, Azure Policy).
• Strong Linux administration and hardening; competent Windows and Active Directory/Entra security.
• Hands\-on firewall management (Palo Alto, Fortinet, pfSense/OPNsense or cloud\-native) and network security fundamentals.
• Cloudflare or equivalent WAF/CDN: rule authoring, rate limiting, bot mitigation, incident tuning.
• Google Workspace security administration.
• Built DevSecOps pipelines: SAST/DAST/SCA/secrets/IaC scanning integrated into GitHub Actions, GitLab CI or Jenkins.
• Proven VAPT skill: web, API and cloud testing with Burp Suite, Nuclei, Nmap, Metasploit and manual methodology (OWASP Top 10, ASVS, PTES).
• Bug bounty track record on HackerOne, Bugcrowd, Intigriti or equivalent, as a hunter or triager, with reportable valid findings.
• Demonstrated experience on both red team (offensive testing, adversary emulation) and blue team (detection engineering, incident response, hardening); you can run a purple\-team exercise end to end.
• Scripting in Python or Bash, plus Git; comfortable with Docker and Kubernetes security basics.
• Clear written communication: findings, runbooks and risk explanations that engineers and executives both understand.

• *Nice\-to\-have**
• -----------------

• Certifications: OSCP, OSWE, CRTP, AWS Security Specialty, AZ\-500, GCIH/GCIA or CISSP.
• Experience securing large device fleets (Android, iOS, macOS) or bare\-metal data\-centre environments.
• Kubernetes security depth: admission control, runtime detection (Falco), network policies, supply\-chain signing.
• Threat modelling and secure design review for multi\-tenant SaaS platforms.
• Published CVEs, conference talks, open\-source security tooling or public write\-ups.
• Experience with SOAR or automating response playbooks.
• Familiarity with GDPR, ISO 27701 or customer\-facing security questionnaires (CAIQ, SIG).

• *Who you are**
• --------------

• **Security\-first, by default.** You treat every design, deploy and access request as a security decision. You push for secure defaults up front instead of bolting on controls after an incident.
• **Hands\-on.** You would rather fix the IAM policy, write the detection rule or reproduce the exploit yourself than file a ticket and wait.
• **Attacker's mindset.** You think about how systems break, chain small weaknesses into real impact, and prove it rather than theorise.
• **Pragmatic.** You rank risk by real exploitability and business impact, ship controls that engineers will actually keep, and know when a compensating control beats a perfect one.
• **Builder and owner.** You are comfortable starting from zero, with no SIEM, no pipeline gates and no bounty program, and turning that into a running system with metrics.
• **Clear communicator.** You write findings engineers can act on and risk summaries leadership can decide on.
• **Calm under incident.** You lead triage without drama, document as you go, and turn every incident into a detection or control improvement.

• *First 90 days**
• ----------------

By Outcome

Day 30 Attack\-surface inventory complete (cloud accounts, on\-prem, SaaS, public assets). Continuous external scanning live with alerting. SIEM platform selected with a costed design signed off.

Day 60 SIEM ingesting AWS, Cloudflare, Google Workspace and endpoint logs with the first 20 high\-value detections. Secrets, SCA and IaC scanning gating CI on core repositories. Bug bounty triage SLA defined and met.

Day 90 SIEM covering Azure, firewalls and Kubernetes with on\-call alert routing. First internal VAPT cycle delivered with critical and high findings remediated. Cloudflare WAF baseline rolled out to all public properties. Security posture dashboard reported to leadership.

• *Interview process**
• --------------------

• Recruiter screen (30 min): background, motivation, logistics.
• Technical deep\-dive with hiring manager (60 min): walk through a SIEM you built, a pipeline you secured and a bounty or VAPT finding you are proud of.
• Hands\-on assessment (take\-home or live, 2–3 hours): a scoped target with cloud misconfigurations and a vulnerable web app; we score methodology, findings and the quality of the write\-up.
• Architecture and incident panel (60 min): threat\-model a multi\-tenant device\-farm platform and run a live incident tabletop.
• Leadership conversation (30 min): ownership, communication and culture fit.

• *To apply:** send your CV plus links to any bounty profiles, CVEs, write\-ups or open\-source work to the hiring team. A short note on the most interesting vulnerability you have found counts more than a cover letter.