Cloud Security Engineer

The Cloud Security Engineer is responsible for helping secure the cloud-native infrastructure, platforms, services, and deployment patterns that support the Paymentus SaaS platform. This role reports to the Manager of Security Engineering and works closely with Engineering, Cloud Infrastructure, DevOps, Platform Engineering, Product, Compliance, Security Operations, and Application Security teams.

This is a hands-on technical role focused on securing Paymentus infrastructure across public cloud, Kubernetes, containers, serverless technologies, CI/CD pipelines, infrastructure as code, cloud identity, network controls, secrets management, logging, monitoring, and cloud-native security tooling.

The successful candidate must have deep practical knowledge of cloud security across AWS, GCP, and Azure, with strong experience securing modern SaaS platforms, web applications, RESTful APIs, microservices, and distributed systems. The role requires the ability to assess cloud architecture, identify insecure patterns, build scalable security controls, automate cloud security checks, and partner directly with engineering teams to remediate risk without unnecessarily slowing delivery.

Education and Experience

• Bachelor’s Degree in Engineering, Computer Science, Software Engineering, Information Security, or a related technical field, or equivalent practical experience.
• 5+ years of experience in cloud security, infrastructure security, platform security, DevSecOps, security engineering, cloud engineering, site reliability engineering, or a closely related technical role.
• Hands‑on experience securing workloads in one or more major public cloud platforms, with strong preference for practical experience across AWS, GCP, and Azure.
• Strong understanding of cloud‑native architecture, SaaS platforms, microservices, distributed systems, RESTful APIs, authentication, authorization, encryption, logging, monitoring, and service-to‑service communication.
• Deep knowledge of cloud identity and access management, including least privilege, role‑based access, service accounts, workload identity, cross‑account access, privileged access, federation, and access governance.
• Hands‑on experience with Kubernetes security, including RBAC, cluster hardening, admission control, network policies, pod security controls, secrets management, workload isolation, and runtime security.
• Hands‑on experience with container security, including image scanning, base image hardening, container registries, image signing or provenance, runtime controls, and containerized application deployment patterns.
• Experience securing serverless technologies, including function permissions, event‑driven architectures, secrets handling, logging, monitoring, and abuse‑prevention patterns.
• Experience with infrastructure as code and policy‑as‑code technologies such as Terraform, CloudFormation, or similar tools.
• Experience securing CI/CD pipelines, source control systems, build systems, artifact repositories, container registries, deployment workflows, and release automation.
• Experience with cloud security tools and practices such as CSPM, CNAPP, CWPP, CIEM, cloud vulnerability management, cloud asset inventory, cloud detection engineering, IaC scanning, container scanning, and secrets scanning.
• Strong knowledge of cloud networking and perimeter controls, including segmentation, routing, firewall rules, private endpoints, load balancers, TLS, DNS, ingress/egress controls, API gateways, and exposure management.
• Familiarity with CDN, WAF, bot mitigation, rate limiting, edge security, and origin protection using platforms such as Cloudflare and Fastly.
• Familiarity with application servers, web servers, and reverse proxy technologies such as Tomcat, JBoss, nginx, or similar platforms.
• Good understanding of modern application security guidelines, including OWASP Top 10, OWASP API Security Top 10, and OWASP Top 10 for Large Language Model Applications.
• Ability to analyze cloud security findings, determine exploitability, identify root cause, and recommend practical remediation steps.
• Ability to work independently, manage multiple priorities, and deliver high-quality results in a fast‑paced engineering environment.
• Strong written and verbal communication skills, including the ability to explain cloud security risks clearly to technical and non‑technical stakeholders.
• Strong collaboration skills and the ability to build trusted working relationships with engineering, product, DevOps, cloud infrastructure, compliance, and security teams.

Preferred Qualifications

• Experience working in fintech, payments, banking, financial services, or another highly regulated SaaS environment.
• Experience with payment processing environments, cardholder data environments, tokenization, payment APIs, transaction platforms, or fraud‑related infrastructure.
• Experience supporting PCI DSS, SOC 2, SOX technology controls, NIST CSF, ISO 27001, or similar security and compliance frameworks.
• Experience securing multi‑cloud environments across AWS, GCP, and Azure.
• Experience with Kubernetes admission controllers, service mesh security, cloud workload identity, runtime detection, image signing, software bill of materials, and supply chain security.
• Experience building cloud security guardrails, secure landing zones, reusable infrastructure modules, secure service templates, policy‑as‑code, or developer self‑service security capabilities.
• Experience with cloud‑native logging and detection tools, including cloud audit logs, SIEM integrations, security data lakes, threat detection rules, and incident investigation workflows.
• Experience with red team findings, penetration testing support, attack‑path analysis, cloud incident response, or cloud threat hunting.
• Relevant certifications such as AWS Security Specialty, Google Professional Cloud Security Engineer, Azure Security Engineer, CCSP, CISSP, CKS, CKAD, CKA, Kubernetes Security Specialist, or equivalent practical experience.

This job operates in a professional office and technology environment. This role routinely uses standard office and engineering equipment, including laptop computers, collaboration tools, cloud platforms, security platforms, source code repositories, ticketing systems, and communication systems. The role requires frequent collaboration with geographically distributed teams and may involve participation in security incident response, urgent vulnerability remediation, production risk reviews, and executive briefings.

Physical Demands

While performing the duties of this job, the employee is regularly required to talk, hear, type, read, and view computer screens for extended periods. Specific vision abilities required by this job include close vision and the ability to adjust focus. The employee may occasionally be required to stand, walk, reach with hands and arms, lift files or equipment, open filing cabinets, bend, or stand on a stool as necessary. The employee may occasionally be required to lift up to 25 lbs.

Position Type/Expected Hours of Work

This is a full‑time position. Days and hours of work are generally Monday through Friday during normal business hours. Occasional evening, weekend, or on‑call work may be required based on business needs, security incidents, critical vulnerabilities, production releases, audit deadlines, or customer commitments.

Travel

Minimal travel is expected. Occasional travel may be required for company meetings, team events, customer security discussions, conferences, audits, or vendor engagements.

Other Duties

This job description is not designed to cover or contain a comprehensive listing of all activities, duties, or responsibilities required of the employee. Duties, responsibilities, and activities may change at any time with or without notice.

EEO Statement

Paymentus is an equal opportunity employer. We enthusiastically accept our responsibility to make employment decisions without regard to race, religious creed, color, age, sex, sexual orientation, national origin, ancestry, citizenship status, religion, marital status, disability, military service or veteran status, genetic information, medical condition including medical characteristics, or any other classification protected by applicable federal, state, provincial, and local laws and ordinances. Our management is dedicated to ensuring the fulfillment of this policy with respect to hiring, placement, promotion, transfer, demotion, layoff, termination, recruitment advertising, pay, and other forms of compensation, training, and general treatment during employment.

Reasonable Accommodation

Paymentus recognizes and supports its obligation to endeavor to accommodate job applicants and employees with known physical or mental disabilities who are able to perform the essential functions of the position, with or without reasonable accommodation. Paymentus will endeavor to provide reasonable accommodations to otherwise qualified job applicants and employees with known physical or mental disabilities, unless doing so would impose an undue hardship on the Company or pose a direct threat of substantial harm to the employee or others.

An applicant or employee who believes he or she needs a reasonable accommodation of a disability should discuss the need for possible accommodation with the Human Resources Department, or his or her direct supervisor.

#J-18808-Ljbffr