Security Engineer III - Infra Security
Meesho · Posted Nov 2
Online marketplace, social commerce, and value-retail services
Bangalore, KarnatakaFull-timeOnsiteSenior Level5–7 years₹40.0L–₹60.0L yearly53 applicants
E-CommerceRetailMarketplaceSocial CommerceLogisticsPublic Company
Full time
Get a personal compatibility score
Add a resume for personal matches
About the role
Meesho's security team builds resilient systems to support an e-commerce platform used by roughly 5% of Indian households, handling millions of orders daily with zero downtime. The team is hiring a Security Engineer 3 for Infrastructure Security, a senior individual contributor role owning infrastructure security and security operations end to end. The role spans GCP organisation policy and IAM, GKE and container hardening, zero trust, Terraform and CI/CD pipeline security, SIEM-driven detection and response, security automation, and AI infrastructure security.
What you will do
- Cloud Security Architecture & Design Review: Own secure design for Meesho's GCP estate, including organisation policies, project structure, IAM and service-account hygiene, VPC design, VPC Service Controls, workload identity, and encryption/key management (Cloud KMS). Lead threat modeling and security reviews for new infrastructure and platform services, and drive the resulting requirements into production with platform engineering.
- Kubernetes & Container Security: Harden GKE clusters and containerised workloads end to end: cluster configuration, RBAC, network policies, admission control and policy-as-code, workload identity, image provenance and registry controls, and runtime posture. Define the secure-by-default patterns that platform and product teams build on.
- Identity & Zero Trust: Drive Meesho's zero-trust roadmap for infrastructure: least-privilege IAM at scale, elimination of long-lived credentials and static keys, just-in-time and break-glass access patterns, secrets management, and strong isolation between production and non-production environments.
- Posture Management & Hardening: Own cloud security posture management using GCP-native tooling (Security Command Center) and complementary controls. Continuously find, prioritise, and burn down misconfigurations and attack paths across the estate, and convert recurring findings into preventive guardrails rather than tickets.
- Infrastructure as Code & Pipeline Security: Embed security into how infrastructure ships: IaC scanning and policy enforcement (Terraform), CI/CD pipeline hardening, artifact and dependency integrity, and software supply-chain controls for infrastructure components.
- SOC & Detection and Response (End-to-End Ownership): Own Meesho's SOC and detection & response function: run the SIEM and the managed detection (MxDR) partner relationship, own alert triage quality, escalation paths, and on-call, and ensure infrastructure telemetry (cloud audit logs, Kubernetes audit, network and identity signals) is onboarded and high-signal. Build and tune detections for cloud-native attack techniques, lead incident response as the senior technical responder, and drive post-incident fixes to architectural closure.
- Security Automation: Design and build automation that multiplies a lean team: auto-remediation for common misconfigurations, access-review tooling, inventory and attack-surface mapping, and self-service security workflows for engineering teams.
- Vulnerability & Patch Management: Own the vulnerability lifecycle for infrastructure: OS and image patching posture, container base-image management, exposure tracking, and remediation SLAs, with metrics that drive engineering prioritisation.
- AI Infrastructure Security: Contribute to securing the infrastructure behind Meesho's AI workloads, including the AI gateway plane, model-access controls, and isolation and egress controls for agents and AI services running in production.
- Mentorship & Security Partnership: Mentor the SE2 on the team, review their work, and raise the team's technical bar. Act as the infrastructure security subject-matter expert for platform, SRE, and DevOps teams, influencing decisions without direct authority.
- Compliance Enablement: Translate control requirements from frameworks such as ISO 27001, SOC 2, the DPDP Act, and CERT-In directions (logging, retention, incident reporting) into pragmatic technical controls, and provide evidence from systems you own.
Skills used in this role
What the employer is looking for
- Experience: 5-7 years of hands-on experience in infrastructure, cloud, or platform security, with a demonstrated track record of owning security outcomes end to end in a production cloud environment.
- Education: A Bachelor's or Master's degree in Computer Science, Information Security, or a related field is preferred.
- Strong hands-on cloud security experience, ideally on GCP (IAM, organisation policy, VPC and VPC Service Controls, Cloud KMS, Security Command Center, audit logging); deep AWS or Azure experience with willingness to go deep on GCP also works.
- Deep, practical Kubernetes security expertise (ideally GKE): RBAC, network policies, admission control, workload identity, image and registry security, and runtime threat detection.
- Proven ability to lead threat modeling for complex distributed infrastructure and translate findings into controls that ship.
- Hands-on experience with infrastructure as code (Terraform) and with embedding security scanning and policy enforcement into CI/CD.
- Strong scripting or programming ability (Python or Go preferred) and a bias toward building automation over running manual reviews.
- Hands-on experience running detection and response: operating a SIEM (ideally with a managed SOC/MxDR partner), knowing what telemetry matters, writing high-signal detections, and leading infrastructure security incidents to closure.
- Solid grounding in Linux, networking, and identity fundamentals (OAuth/OIDC, SAML, service identity).
- Sound judgment on risk prioritisation at scale: knowing which of a thousand findings actually matter and why.
- Comfort operating in a lean team: self-directed, pragmatic about scope, and able to drive initiatives to closure across platform, SRE, and DevOps teams without direct authority.
- Excellent communication skills, able to explain infrastructure risk to both engineers and leadership.
- Ability and willingness to mentor an earlier-career security engineer.
Preferred qualifications
- Relevant certifications such as CKS (Certified Kubernetes Security Specialist), Google Professional Cloud Security Engineer, OSCP, or GCPN.
- Experience with zero-trust architecture rollouts or large-scale IAM remediation programmes.
- Experience operating or integrating with a SIEM/SOC, including detection-as-code practices.
- Exposure to securing AI/LLM infrastructure (model gateways, agent isolation, egress controls) and software supply-chain security (SLSA, artifact signing).
- Offensive security exposure: cloud-focused red teaming, attack-path analysis, or published research/CVEs.
- Exposure to India regulatory requirements such as the DPDP Act and CERT-In directions.
- Experience speaking at meetups or conferences.
Benefits and support
- Compensation and benefits are detailed in the job posting
About Meesho
Meesho is an Indian e-commerce platform that enables small businesses, individuals, and manufacturers to sell products online across various categories like fashion, home, and beauty. Operating a zero-commission marketplace model, the company focuses on serving value-conscious consumers primarily in tier-2, tier-3, and rural regions. It has scaled significantly to connect millions of buyers with local suppliers and independent sellers.
- Industry
- E-Commerce
- Company size
- 1001-5000 employees
- Founded
- December 2015
- Location
- Bengaluru, Karnataka, India
- Funding stage
- Public Company
Funding
Public Company · $1.36B raised
Tiger Global ManagementPeak XV PartnersSoftBank Vision FundMetaWestBridge CapitalY CombinatorElevation Capital
- 2016-05-05Angel$350K
- 2017-10-01Series A$3.1M
- 2018-06-01Series B$11.5M
- 2018-11-01Series C$50M
- 2019-06-01Corporate Round$25M
- 2019-08-01Series D$125M
- 2021-04-01Series E$300M
- 2021-09-01Series F$570M
- 2023-09-11Secondary Market$52.5M
- 2024-05-11Venture Round$275M
- 2025-01-27Series FUndisclosed
Leadership
VA
Vidit Aatrey
Founder & Chief Executive Officer
SB
Sanjeev Barnwal
Co-founder & Chief Technology Officer
DB
Dhiresh Bansal
Chief Financial Officer
DM
Debdoot Mukherjee
Chief Data Scientist, Head of AI and Demand Engineering
Recent coverage
TechCrunch
Meesho's $606M IPO pops as enthusiasm for India's e-commerce startups rises2025-12-10
TechCrunch
SoftBank stays in as Meesho $606M IPO becomes India's first major e-commerce listing2025-11-28
People Matters
E-commerce giant Meesho secures $270 million in new funding round ahead of IPO2025-02-02