SDE3, Infrastructure Security Engineer (DevSecOps)

About the Role

About the team Sarvam builds Indic-language AI used at population scale. The CPU Infrastructure team runs everything outside the GPU fleet: Kubernetes across Azure, AWS, GCP and Indian sovereign clouds, the network between them, Cloudflare, identity, secrets, observability, cost and the delivery pipeline every product ships through. The team builds and runs what it builds. Engineers own real systems end to end, and every repeated piece of manual work is a candidate for automation. As an AI company, we are building AI agents into our own operations, to plan and review infrastructure changes, triage alerts and handle routine issues, with engineers setting the guardrails. About the role You are an infrastructure engineer whose first instinct is security, and who builds rather than only operates. You have worked on banking, fintech, payments or similarly regulated products, where a misconfiguration is an incident and an audit is routine. Here you set what “secure” means across Sarvam’s infrastructure and build the automation that enforces it, so security is a property of the pipeline rather than a review step. You work closely with the compliance team. This is a hands-on role: most of your time goes into building, and you guide engineering teams across Sarvam on security — setting standards, reviewing security-relevant work and mentoring engineers. Responsibilities • Define and enforce security baselines for Kubernetes, cloud accounts, container images and CI/CD across all clouds • Write the policy gates in the delivery pipeline (OPA / Conftest, Kyverno or equivalent): network exposure, IAM, image provenance, secrets, data residency • Own secrets and workload identity: Vault or cloud-native equivalents, rotation, short-lived and scoped credentials, no long-lived keys • Build detection and response: runtime security (Falco / Tetragon or equivalent), log-based detections, alerting and playbooks • Run the finding-to-fix loop for security findings: triage, assign

Key Responsibilities

• Define and enforce security baselines for Kubernetes, cloud accounts, container images and CI/CD across all clouds
• Write the policy gates in the delivery pipeline (OPA / Conftest, Kyverno or equivalent): network exposure, IAM, image provenance, secrets, data residency
• Own secrets and workload identity: Vault or cloud-native equivalents, rotation, short-lived and scoped credentials, no long-lived keys
• Build detection and response: runtime security (Falco / Tetragon or equivalent), log-based detections, alerting and playbooks
• Run the finding-to-fix loop for security findings: triage, assign

Requirements & Qualifications

• Strong problem solving foundations, knowledge of modern engineering practices, and interest in technology systems.

Perks & Benefits

• Official mentor support
• verified hiring timeline
• and career progression.