Staff Security Operations Engineer

We need to hire two mid-level security professionals dedicated to security operations to strengthen our monitoring, incident response, and proactive security testing capabilities. This role combines monitoring and active security involvement, offering exposure to data-center security in the US and India, with opportunities to attend major conferences like DEF CON and NullCon.

What you'll do

• Increase the efficiency of security monitoring by implementing and fine-tuning SIEM tools, cloud, and endpoint monitoring for comprehensive threat detection.

• Lead penetration testing and attack simulation exercises, identifying and resolving vulnerabilities to fortify system defenses.

• Conduct alert investigations and threat hunting to stay ahead of potential security threats and ensure timely incident response.

• Manage incident response processes, coordinating containment efforts and tracking remediation efforts to closure.

Requirements

• 4–7 years in Security (Cyber, Red Team, Blue team).

• OSCP certification.

• Experience in penetration testing and attack simulation.

• Knowledge in security monitoring with SIEM tools.

• Experience with cloud and endpoint monitoring, alert investigation, and threat hunting.

• Demonstrated incident response skills.

Nice to have

• Experience securing Linux, Kubernetes, and CI/CD environments.

• Knowledge of securing cloud infrastructure.

• Experience with on-prem servers.

Why this seat exists now

We are strengthening our security operations by hiring two mid-level professionals focused on enhancing our monitoring, incident response, and proactive security testing capabilities.

Read this first

You are likely in a role that focuses only on monitoring right now, without exposure to the broader scope of security operations. This position at TestMu AI offers you a combination of both monitoring and active security involvement. Gain invaluable experience in data-center security in the US and India, with the added perks of attending major conferences like DEF CON and NullCon, and explore potential sponsorship for US travel.

Who this isn't for

• Candidates who only want to focus on monitoring without broader security operations involvement.

• Those unable to work onsite in Noida.

• Individuals not interested in participating in conferences or potential travel.

Who you are

• Security-first, by default. You treat every design, deploy and access request as a security decision. You push for secure defaults up front instead of bolting on controls after an incident.

• Hands-on. You would rather fix the IAM policy, write the detection rule or reproduce the exploit yourself than file a ticket and wait.

• Attacker's mindset. You think about how systems break, chain small weaknesses into real impact, and prove it rather than theorise.

• Pragmatic. You rank risk by real exploitability and business impact, ship controls that engineers will actually keep, and know when a compensating control beats a perfect one.

• Builder and owner. You are comfortable starting from zero, with no SIEM, no pipeline gates and no bounty program, and turning that into a running system with metrics.

• Clear communicator. You write findings engineers can act on and risk summaries leadership can decide on.

• Calm under incident. You lead triage without drama, document as you go, and turn every incident into a detection or control improvement.

First 90 Days

Day 30 :Attack-surface inventory complete (cloud accounts, on-prem, SaaS, public assets). Continuous external scanning live with alerting. SIEM platform selected with a costed design signed off.

• Day 60 :SIEM ingesting AWS, Cloudflare, Google Workspace and endpoint logs with the first 20 high-value detections. Secrets, SCA and IaC scanning gating CI on core repositories. Bug bounty triage SLA defined and met.

• Day 90 :SIEM covering Azure, firewalls and Kubernetes with on-call alert routing. First internal VAPT cycle delivered with critical and high findings remediated. Cloudflare WAF baseline rolled out to all public properties. Security posture dashboard reported to leadership.

Interview process

• Recruiter screen (30 min): background, motivation, logistics.

• Technical deep-dive with hiring manager (60 min): walk through a SIEM you built, a pipeline you secured and a bounty or VAPT finding you are proud of.

• Hands-on assessment (take-home or live, 2–3 hours): a scoped target with cloud misconfigurations and a vulnerable web app; we score methodology, findings and the quality of the write-up.

• Architecture and incident panel (60 min): threat-model a multi-tenant device-farm platform and run a live incident tabletop.

• Leadership conversation (30 min): ownership, communication and culture fit.

How to apply

To apply: send your CV plus links to any bounty profiles, CVEs, write-ups or open-source work to the hiring team. A short note on the most interesting vulnerability you have found counts more than a cover letter.