Senior Info Sec Engineer

Cimpress India is seeking a Senior Information Security Engineer who will take full ownership of security initiatives across cloud environments. The role involves leading incident responses, managing vulnerabilities, and providing practical security architecture guidance while collaborating with cross-functional teams.

Responsibilities:

• Perform hands-on security architecture reviews for workloads deployed across AWS, OCI, Azure, and GCP, ensuring alignment with CIS Benchmarks, CSA Cloud Controls Matrix (CCM), and the NIST Cybersecurity Framework (CSF)
• Evaluate and provide actionable security recommendations for IaaS, PaaS, and SaaS environments, covering but not limited to network segmentation, identity and access management (IAM), encryption, logging, and data protection
• Review cloud & application resource configurations, threat modelling, infrastructure-as-code templates, and deployment pipelines to identify security gaps before they reach production
• Collaborate with engineering and DevOps teams to embed security controls into the software development lifecycle (SDLC) and cloud deployment workflows, following the principles of the AWS Well-Architected Framework Security Pillar and Azure Security Benchmark
• Own the end-to-end vulnerability management lifecycle: identification, assessment, prioritisation, tracking, remediation coordination, and stakeholder reporting
• Operate and manage vulnerability assessment tools, specifically Orca Security, Microsoft Defender Security Posture Management, and Azure Security Posture Management, to maintain continuous visibility across the cloud estate
• Coordinate remediation of findings from annual external penetration tests, working directly with application and infrastructure teams to drive timely closure within agreed SLAs, and independently validate fixes through retesting
• Produce vulnerability trend reports, communicate remediation progress and residual risk to technical and non-technical stakeholders
• Apply CVSS, EPSS, and risk-based prioritisation methodologies (aligned with frameworks such as NIST SP 800-40 and OWASP Risk Rating) to ensure remediation efforts are focused on what matters most
• Perform Security Operations Center (SOC) activities, including triage, threat hunting, and investigation of security events across the environment
• Lead and coordinate end-to-end incident response for security incidents, following the NIST SP 800-61 Incident Handling framework and the SANS Incident Response Process (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned)
• Conduct hands-on digital forensics investigations, including evidence collection, analysis, timeline reconstruction, and root cause determination
• Operate and manage CrowdStrike EDR for endpoint detection, threat hunting, SOAR Automation, use case implementation and response actions across the endpoint fleet
• Utilise Hunters.io/Splunk/QRadar SIEM for log correlation, management, use case implementation and building detection rules to improve SOC detection coverage
• Prepare detailed incident reports, conduct post-incident reviews, and drive remediation actions to prevent recurrence
• Map adversary tactics and techniques to the MITRE ATT&CK Framework to strengthen detection engineering and improve threat visibility
• Leverage Dark & Deep Web Monitoring tool like Google Threat Intelligence (GTI)/Cyble/Flare.io, CloudSek etc. to proactively identify, analyse, and contextualise threats relevant to the organisation
• Monitor and assess emerging threats, vulnerabilities, and attack trends, incorporating intelligence from open-source threat feeds, ISAC reports, and vendor advisories alongside GTI findings
• Contribute to the development of threat-informed defence strategies using the MITRE ATT&CK Framework, the Cyber Kill Chain model, and the Diamond Model of Intrusion Analysis
• Operate SAST tooling and Snyk/SonarQube (SCA) to help development teams identify and remediate code-level and dependency vulnerabilities across the SDLC
• Serve as the point of contact for internal teams, providing clear and practical guidance on security-related queries and decisions. Translating complex technical findings into clear, understandable language for non-technical stakeholder, ensuring security outcomes drive informed business decisions
• Coordinate and communicate effectively with engineering, IT operations, and compliance teams during security incidents, reviews, and project engagements
• Drive security awareness and best practices across the organisation through documentation, knowledge sharing, and advisory support

Requirements:

• Minimum 4+ years of hands-on experience in Information Security or Cybersecurity roles, with demonstrated depth across the mandatory skill domains listed above
• Perform hands-on security architecture reviews for workloads deployed across AWS, OCI, Azure, and GCP, ensuring alignment with CIS Benchmarks, CSA Cloud Controls Matrix (CCM), and the NIST Cybersecurity Framework (CSF)
• Evaluate and provide actionable security recommendations for IaaS, PaaS, and SaaS environments, covering but not limited to network segmentation, identity and access management (IAM), encryption, logging, and data protection
• Review cloud & application resource configurations, threat modelling, infrastructure-as-code templates, and deployment pipelines to identify security gaps before they reach production
• Collaborate with engineering and DevOps teams to embed security controls into the software development lifecycle (SDLC) and cloud deployment workflows, following the principles of the AWS Well-Architected Framework Security Pillar and Azure Security Benchmark
• Own the end-to-end vulnerability management lifecycle: identification, assessment, prioritisation, tracking, remediation coordination, and stakeholder reporting
• Operate and manage vulnerability assessment tools, specifically Orca Security, Microsoft Defender Security Posture Management, and Azure Security Posture Management, to maintain continuous visibility across the cloud estate
• Coordinate remediation of findings from annual external penetration tests, working directly with application and infrastructure teams to drive timely closure within agreed SLAs, and independently validate fixes through retesting
• Produce vulnerability trend reports, communicate remediation progress and residual risk to technical and non-technical stakeholders
• Apply CVSS, EPSS, and risk-based prioritisation methodologies (aligned with frameworks such as NIST SP 800-40 and OWASP Risk Rating) to ensure remediation efforts are focused on what matters most
• Perform Security Operations Center (SOC) activities, including triage, threat hunting, and investigation of security events across the environment
• Lead and coordinate end-to-end incident response for security incidents, following the NIST SP 800-61 Incident Handling framework and the SANS Incident Response Process (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned)
• Conduct hands-on digital forensics investigations, including evidence collection, analysis, timeline reconstruction, and root cause determination
• Operate and manage CrowdStrike EDR for endpoint detection, threat hunting, SOAR Automation, use case implementation and response actions across the endpoint fleet
• Utilise Hunters.io/Splunk/QRadar SIEM for log correlation, management, use case implementation and building detection rules to improve SOC detection coverage
• Prepare detailed incident reports, conduct post-incident reviews, and drive remediation actions to prevent recurrence
• Map adversary tactics and techniques to the MITRE ATT&CK Framework to strengthen detection engineering and improve threat visibility
• Leverage Dark & Deep Web Monitoring tool like Google Threat Intelligence (GTI)/Cyble/Flare.io, CloudSek etc. to proactively identify, analyse, and contextualise threats relevant to the organisation
• Monitor and assess emerging threats, vulnerabilities, and attack trends, incorporating intelligence from open-source threat feeds, ISAC reports, and vendor advisories alongside GTI findings
• Contribute to the development of threat-informed defence strategies using the MITRE ATT&CK Framework, the Cyber Kill Chain model, and the Diamond Model of Intrusion Analysis
• Operate SAST tooling and Snyk/SonarQube (SCA) to help development teams identify and remediate code-level and dependency vulnerabilities across the SDLC
• Serve as the point of contact for internal teams, providing clear and practical guidance on security-related queries and decisions
• Coordinate and communicate effectively with engineering, IT operations, and compliance teams during security incidents, reviews, and project engagements
• Drive security awareness and best practices across the organisation through documentation, knowledge sharing, and advisory support
• Candidates with a strong progression from roles like Cloud Security, Endpoint Security, Network Security, SOC, Security Architect, Threat Intelligence, Application Security, Data Security, Perimeter Security into Senior Security Engineering positions are encouraged to apply
• Experience working in multi-cloud environments and coordinating security operations across distributed teams is strongly valued
• CompTIA Security+, CEH, CCNA Security
• Cloud security certifications such as AWS Certified Security – Specialty, AZ-500 (Azure Security Engineer Associate), Google Professional Cloud Security Engineer, or CCSP (Certified Cloud Security Professional)
• CISM, CISSP, CISA