Security Engineer III - Infra Security

About the job

About the Team   The security team at Meesho is like the Avengers to Meesho's S.H.I.E.L.D. After all, when 5% of Indian households shop with us, it’s important to build resilient systems to manage millions of orders every day. We’ve done this – with zero downtime! 😎 Sounds impossible? Well, that’s the kind of Engineering muscle that has helped Meesho become the e-commerce giant it is today. We value speed over perfection, and see failures as opportunities to become better. We’ve taken steps to inculcate a strong ‘Founder’s Mindset’ across our engineering teams, making us grow and move fast. We place special emphasis on the continuous growth of each team member - and we do this with regular 1-1s and open communication. As a Security Engineer, you will be part of self-starters who thrive on teamwork and constructive feedback. We know how to party as hard as we work! If we aren’t building unparalleled tech solutions, you can find us debating the plot points of our favorite books and games – or even gossiping over chai. So, if a day filled with building impactful solutions with a fun team sounds appealing to you, join us.   About the Role   As a Security Engineer 3 in Infrastructure Security, you are a senior individual contributor who owns Meesho's infrastructure security and security operations (SOC) end to end. You will be one of the engineers securing everything from GCP organisation policy and IAM down to Kubernetes workloads and CI/CD infrastructure, so you will set the technical direction for infrastructure security, not just execute it. You operate with limited supervision, act as the trusted security voice in infrastructure and platform architecture discussions, and partner closely with other engineers whom you will mentor and uplevel.  The role rewards breadth with depth: you should be comfortable moving between cloud architecture reviews, hands-on hardening, detection engineering, and incident response in the same week, and you will have unusual freedom to automate, consolidate, and build the guardrails that let a lean team secure a platform operating at Meesho's scale.

What you will do Cloud Security Architecture & Design Review: Own secure design for Meesho's GCP estate, including organisation policies, project structure, IAM and service-account hygiene, VPC design, VPC Service Controls, workload identity, and encryption/key management (Cloud KMS). Lead threat modeling and security reviews for new infrastructure and platform services, and drive the resulting requirements into production with platform engineering.

Kubernetes & Container Security: Harden GKE clusters and containerised workloads end to end: cluster configuration, RBAC, network policies, admission control and policy-as-code, workload identity, image provenance and registry controls, and runtime posture. Define the secure-by-default patterns that platform and product teams build on.

Identity & Zero Trust: Drive Meesho's zero-trust roadmap for infrastructure: least-privilege IAM at scale, elimination of long-lived credentials and static keys, just-in-time and break-glass access patterns, secrets management, and strong isolation between production and non-production environments.

Posture Management & Hardening: Own cloud security posture management using GCP-native tooling (Security Command Center) and complementary controls. Continuously find, prioritise, and burn down misconfigurations and attack paths across the estate, and convert recurring findings into preventive guardrails rather than tickets.

Infrastructure as Code & Pipeline Security: Embed security into how infrastructure ships: IaC scanning and policy enforcement (Terraform), CI/CD pipeline hardening, artifact and dependency integrity, and software supply-chain controls for infrastructure components.

SOC & Detection and Response (End-to-End Ownership): Own Meesho's SOC and detection & response function: run the SIEM and the managed detection (MxDR) partner relationship, own alert triage quality, escalation paths, and on-call, and ensure infrastructure telemetry (cloud audit logs, Kubernetes audit, network and identity signals) is onboarded and high-signal. Build and tune detections for cloud-native attack techniques, lead incident response as the senior technical responder, and drive post-incident fixes to architectural closure.

Security Automation: Design and build automation that multiplies a lean team: auto-remediation for common misconfigurations, access-review tooling, inventory and attack-surface mapping, and self-service security workflows for engineering teams.

Vulnerability & Patch Management: Own the vulnerability lifecycle for infrastructure: OS and image patching posture, container base-image management, exposure tracking, and remediation SLAs, with metrics that drive engineering prioritisation.

AI Infrastructure Security: Contribute to securing the infrastructure behind Meesho's AI workloads, including the AI gateway plane, model-access controls, and isolation and egress controls for agents and AI services running in production.

Mentorship & Security Partnership: Mentor the SE2 on the team, review their work, and raise the team's technical bar. Act as the infrastructure security subject-matter expert for platform, SRE, and DevOps teams, influencing decisions without direct authority.

Compliance Enablement: Translate control requirements from frameworks such as ISO 27001, SOC 2, the DPDP Act, and CERT-In directions (logging, retention, incident reporting) into pragmatic technical controls, and provide evidence from systems you own.

What you will need Experience: 5-7 years of hands-on experience in infrastructure, cloud, or platform security, with a demonstrated track record of owning security outcomes end to end in a production cloud environment.

Education: A Bachelor's or Master's degree in Computer Science, Information Security, or a related field is preferred.

Core Technical Depth:

- Strong hands-on cloud security experience, ideally on GCP (IAM, organisation policy, VPC and VPC Service Controls, Cloud KMS, Security Command Center, audit logging); deep AWS or Azure experience with willingness to go deep on GCP also works.

- Deep, practical Kubernetes security expertise (ideally GKE): RBAC, network policies, admission control, workload identity, image and registry security, and runtime threat detection.

- Proven ability to lead threat modeling for complex distributed infrastructure and translate findings into controls that ship.

- Hands-on experience with infrastructure as code (Terraform) and with embedding security scanning and policy enforcement into CI/CD.

- Strong scripting or programming ability (Python or Go preferred) and a bias toward building automation over running manual reviews.

- Hands-on experience running detection and response: operating a SIEM (ideally with a managed SOC/MxDR partner), knowing what telemetry matters, writing high-signal detections, and leading infrastructure security incidents to closure.

- Solid grounding in Linux, networking, and identity fundamentals (OAuth/OIDC, SAML, service identity).

General Skills & Acumen:

- Sound judgment on risk prioritisation at scale: knowing which of a thousand findings actually matter and why.

- Comfort operating in a lean team: self-directed, pragmatic about scope, and able to drive initiatives to closure across platform, SRE, and DevOps teams without direct authority.

- Excellent communication skills, able to explain infrastructure risk to both engineers and leadership.

- Ability and willingness to mentor an earlier-career security engineer.

Bonus Points

- Relevant certifications such as CKS (Certified Kubernetes Security Specialist), Google Professional Cloud Security Engineer, OSCP, or GCPN.

- Experience with zero-trust architecture rollouts or large-scale IAM remediation programmes.

- Experience operating or integrating with a SIEM/SOC, including detection-as-code practices.

- Exposure to securing AI/LLM infrastructure (model gateways, agent isolation, egress controls) and software supply-chain security (SLSA, artifact signing).

- Offensive security exposure: cloud-focused red teaming, attack-path analysis, or published research/CVEs.

- Exposure to India regulatory requirements such as the DPDP Act and CERT-In directions.

- Experience speaking at meetups or conferences.

About us  Welcome to Meesho, where every story begins with a spark of inspiration and a dash of entrepreneurial spirit. We're not just a platform; we're your partner in turning dreams into realities. Curious about life at Meesho? Explore our Glassdoor - our people have a lot to say and they've helped us become a loved workplace in India. Our Mission Democratising internet commerce for everyone — Meesho (Meri Shop) started with a single idea in mind: to be an e-commerce destination for Indian consumers and to enable small businesses to succeed online. We provide our sellers with benefits such as zero commission and affordable shipping solutions in the market. Today, sellers nationwide are growing their businesses by tapping into Meesho’s large and diverse customer base, state-of-the-art tech infrastructure, and pan-India logistics network through trusted third-party partners. Affordable, relatable merchandise that mirrors local markets has helped us connect with internet users and serve customers across urban, semi-urban, and rural India. Our unique business model and continuous innovation have established us as a part of India’s e-commerce ecosystem. Culture and Total Rewards Our focus is on cultivating a dynamic workplace characterized by high impact and performance excellence. We prioritize a people-centric culture, dedicated to hiring and developing exceptional talent. Total rewards at Meesho comprise a comprehensive set of elements — monetary, non-monetary, tangible, and intangible. Our 9 guiding principles, or "Mantras," are the backbone of how we operate, influencing everything from recognition and evaluation to growth discussions. Daily rituals and processes like “Problem First Mindset,” “Listen or Die,” our Internal Mobility Program, Talent Reviews, and Continuous Performance Management embody these principles. We offer competitive compensation — both cash and equity-based — tailored to job roles, individual experience, and skill, along with employee-centric benefits and a supportive work environment. Our holistic wellness program, MeeCare, includes benefits across physical, mental, financial, and social wellness. This includes extensive medical insurance for employees and their families, wellness initiatives like telehealth, wellness events, and fitness-related perks. To support work-life balance, we offer generous leave policies, parental support, retirement benefits, and learning and development assistance. Through personalized recognition, gratitude for stretched work, and engaging activities, we promote employee delight at the workplace. Additional benefits such as salary advance support, relocation assistance, and flexible benefit plans further enrich the Meesho experience. At Meesho, we are committed to creating an inclusive and accessible workplace where every individual can thrive. In compliance with the Rights of Persons with Disabilities Act, 2016, we uphold the following principles: Equal Opportunity: We ensure that employment opportunities are never denied on the grounds of disability if the candidate is otherwise competent to perform the job. Accessible Workplace: Our facilities are designed to be fully accessible, with amenities and assistive devices provided to support differently abled individuals in their work. Inclusive Hiring Process: We adopt a transparent and non-discriminatory selection process, including providing application forms in alternate formats and offering reasonable accommodations during interviews upon request. Career Growth: We provide adequate training post-recruitment