Information Security Engineer

Bureau, Bangalore

The role

We are looking for a Security Engineer who can own both the hands-on technical security stack and our governance/compliance programs.

What you’ll be doing

What you will do

Wait…

Harden and monitor our cloud & container infrastructure (AWS/EKS, endpoints, network).
Run vulnerability management, security tooling and incident response.
Help maintain our ISMS and support audits (ISO 27001, SOC 2, RBI, DPDP, etc.).

This is ideal for someone who doesn’t want to be only “checklist GRC” or only “pure blue-team”, but wants a blended role across security engineering + GRC.Key Responsibilities

Cloud & Infrastructure Security (Hands-on)
Work with DevOps to secure our AWS/EKS environment:
IAM hardening, security groups, VPC, KMS, S3, RDS, etc.
Review infra-as-code (Terraform/Helm) for security issues and misconfigurations.
Own or co-own key security tools:
Endpoint / EDR (e.g., CrowdStrike / SentinelOne),
Cloud security (CSPM / CNAPP, GuardDuty, Security Hub, WAF, etc.),
Container / runtime security where applicable.
Implement and maintain logging & monitoring for security events (CloudTrail, ALB/NLB logs, K8s logs, etc.), and integrate them with SIEM / alerting.
Vulnerability Management & Security Operations
Own the vulnerability management lifecycle:
Run periodic scans for cloud, endpoints, containers and apps.
Triage findings, prioritise based on risk, and drive closure with engineering.
Coordinate external pentests / bug bounties and track remediation.
Support incident response:
Help investigate alerts, gather evidence, and contribute to RCA and CAPA.
Maintain and update incident runbooks.
Governance, Risk & Compliance (ISMS, Audits, DPDP)
Maintain and enhance the Information Security Management System (ISMS):
Policies, procedures, SoA, risk register, control evidence and audit trails.
Support internal and external audits: ISO 27001, SOC 2, RBI/CERT-In, Data Protection.
Prepare and manage audit evidence, observations, closure reports and certification documentation.
Assist with risk assessments:
Maintain the risk register, risk treatment plans and residual risk reviews.
Conduct vendor security due diligence and maintain vendor security records (MSA, NDA, DPA, DPIA, etc.).
Support privacy & regulatory compliance operations (GDPR/DPDP basics: retention, consent, grievance logging).
Access, Asset & Control Assurance
Participate in and help automate access reviews, asset inventory checks, and configuration compliance checks.
Track control performance (vuln SLAs, access reviews, backup tests, etc.) and ensure gaps are documented and closed.
Maintain security awareness and training trackers (onboarding, annual refreshers, phishing simulations).

Information Security Engineer

The role

What you will do

Information Security Engineer

The role

What you will do

What you need

What You’ll Bring

Who You Are

Nice to have

Pay and benefits

About Bureau

About Bureau

Our culture

Similar jobs at other companies

Sr. Security Engineer

Security Engineer

Staff Security Engineer

Security Engineer

Senior Cloud Security Engineer

Senior Cloud Security Engineer

Bureau