Join Sarvam, a pioneering AI company building Indic-language AI solutions for large-scale applications. Our CPU Infrastructure team is responsible for managing all systems outside the GPU fleet, including Kubernetes across major cloud providers, networking, identity, secrets management, observability, and our delivery pipelines. We foster an environment where engineers own systems end-to-end and champion automation for all repetitive tasks. Leveraging AI agents in our operations, we aim to enhance planning, review infrastructure changes, and manage routine issues, with engineers providing crucial oversight.

This role is designed for an infrastructure engineer who prioritizes security in their design and development processes. Experience with regulated products in banking, fintech, or payments is highly valued. You will be instrumental in defining Sarvam's infrastructure security standards and developing automation to embed security directly into our pipelines, ensuring it's an integral part of the development lifecycle, not merely a checkpoint. Close collaboration with the compliance team will be key.

This is a hands-on position focused on building and guiding engineering teams. You'll establish security standards, review security-related work, and mentor engineers across Sarvam, ensuring robust security practices are adopted universally.

Establish and enforce comprehensive security baselines for Kubernetes, cloud environments, container images, and CI/CD pipelines across all cloud platforms. Develop policy-as-code enforcement mechanisms within the delivery pipeline, covering aspects like network exposure, IAM, image provenance, secrets handling, and data residency. Take ownership of secrets management and workload identity, utilizing tools like Vault or cloud-native solutions for secure rotation, short-lived credentials, and eliminating long-lived keys. Build robust detection and response capabilities, including runtime security (e.g., Falco/Tetragon), log-based threat detection, and establishing effective alerting and incident response playbooks. Manage the complete lifecycle of security findings, from triage and assignment to resolution, detection enhancement, and retesting. Integrate LLMs and AI agents into security workflows for tasks such as triaging findings, reviewing infrastructure changes, fine-tuning detections, and drafting incident timelines, while ensuring the agents themselves are secured with scoped permissions and audit trails. Strengthen the software supply chain through image signing and scanning, dependency policy management, and the generation of Software Bills of Materials (SBOMs). Automate the generation of compliance evidence for standards like CERT-In, ISO 27001, SOC 2, and DPDP in partnership with the compliance team. Define and communicate security standards for all engineers and conduct thorough reviews of security-relevant changes. Participate in on-call rotations and take a leading role in managing security incidents.

A minimum of 5 to 9 years of experience in DevOps, platform, or security engineering is required, with at least 2 years in a banking, fintech, payments, or similarly regulated industry. Possess strong foundational knowledge of Kubernetes and Linux, with demonstrated experience managing production clusters on at least one major cloud platform. Demonstrate hands-on proficiency with infrastructure-as-code tools such as Terraform or OpenTofu, and experience with GitOps workflows using ArgoCD or Flux. Hands-on experience in building security automation, including policy-as-code implementations, secrets rotation mechanisms, CI/CD security gates, or threat detection pipelines. Solid working knowledge of Identity and Access Management (IAM), network security principles, TLS configurations, and secrets management across various cloud environments. Proficiency in scripting and tooling using Python or Go. Previous experience participating in security audits and a clear understanding of the evidence required by auditors. Experience in building or utilizing AI-based automation for infrastructure or security tasks, coupled with an understanding of AI agent risks such as prompt injection, overly broad permissions, and unreviewed actions. A strong advantage would be experience with Vault, SPIFFE/SPIRE, Falco/Tetragon, Cloudflare WAF, leading incident response efforts, or multi-cloud environments.