About Amartha Amartha is a technology company focused on shared prosperity through digital financial solutions for the grassroots economy. Founded in 2010 as a microfinance institution, it connects rural, women-led micro-enterprises with affordable capital. Amartha is expanding its technology capabilities by developing a microfinance ecosystem linked to the digital economy through capital, investment, and payment services. By strengthening micro and small entrepreneurs, Amartha supports women-led MSMEs, job creation, and inclusive economic growth. Its Empowered to Grow culture is based on focusing on clarity, taking the lead, and growing impact, with employees encouraged to take ownership and create meaningful, lasting results. About the role Amartha is an Indonesian fintech group providing financial services to micro-entrepreneurs through licensed entities in lending, payments, and related services. Its production platform operates on Google Cloud and Kubernetes, while the security team develops the controls, detection, and automation required by a regulated lender at this scale. The Senior Security Engineer will lead cloud and platform security engineering. Responsibilities include operating controls that detect and prevent misconfiguration and intrusion across the cloud and container environment, responding to findings from the detection stack, and converting manual security infrastructure into code. The role works closely with DevOps and platform engineering, with deliverables contributing directly to ISO 27001 and regulator audit evidence. This is a hands-on individual contributor position with a broad scope. The successful candidate will serve as the senior cloud security voice on the team and set its technical direction proactively. What you will do Own container and cloud runtime security, including workload isolation, Kubernetes hardening, and runtime threat detection. Operate and expand automated benchmark and configuration scanning across the cloud platform and productivity suite, and act on its findings. Integrate shift-left security into CI/CD through infrastructure-as-code scanning and pre-deployment misconfiguration gates. Bring the security team’s cloud environment under infrastructure as code. Provisioning is currently manual and prone to drift, and eliminating this condition is a defined deliverable of the role. Build and operate the deployment pipeline for security tooling so that security infrastructure is delivered in the same manner as the product. Own the SIEM platform end to end, including network isolation, version currency, configuration management, and detection coverage for critical workloads. Respond to and review security alerts, tune detection rules, and reduce false positives. Manage edge and perimeter security, including web application firewall rules, DNS and traffic visibility, and security event retention. Manage platform and console access paths assigned to security engineering. Document solutions to a standard that enables another engineer to operate them independently. Continuity is a measured outcome of this role. Participate in the information security on-call rotation and help establish it. Produce control evidence requested by auditors and regulators in collaboration with the GRC team. What you bring 5 or more years of experience in security engineering, infrastructure engineering, or SRE, including at least 3 years focused on cloud and container security. Hands-on expertise in public cloud and Kubernetes security, including identity and access management, RBAC, workload identity, network policy, admission control, runtime detection, and secret management. Google Cloud is the primary platform. Production experience with a SIEM, including deployment, detection rule authoring, and alert triage. Practical infrastructure-as-code experience, including reusable modules, state management, and deployment pipelines personally built and operated. Experience integrating security scanning into CI/CD, such as infrastructure-as-code scanning, static analysis, container image scanning, or policy as code. Working knowledge of cloud benchmark and hardening standards, along with the judgement to determine which findings require action. Scripting and automation skills in Python, Go, or Bash. A consistent documentation practice. The role requires an engineer who writes runbooks proactively because continuity is as important as technical capability. Fluent written and spoken Bahasa Indonesia and English. Nice to have Experience at a regulated financial institution, such as a bank, multifinance company, P2P lending platform, payment provider, or e-money issuer. Familiarity with Indonesian regulations on information technology risk and data protection in financial services, particularly POJK 4/2021 and UU PDP. Exposure to ISO 27001 control evidence, internal audits, or external certification audits. A cloud or Kubernetes security certification, such as GCP Professional Cloud Security Engineer, CKS, or an equivalent credential. Exposure to threat intelligence platforms, vulnerability and finding management, or cloud compliance and posture management. Experience establishing or operating an on-call rotation for a security function. Multi-cloud experience, particularly migration between major cloud providers. Amartha is committed to a workplace that celebrates diversity, ensures equity, and promotes inclusion. The company believes perspectives shaped by gender, age, race, ethnicity, education, culture, and life experiences support innovation and growth. Individuals from all backgrounds are welcome to help create an environment where everyone is respected, valued, and empowered. Amartha provides equal opportunities and aims to foster belonging so employees can thrive and make meaningful contributions.

Senior Security Engineer (Cloud and Platform Security)

Deskripsi Pekerjaan

Ringkasan

Lowongan Terkait Lainnya

Head of Information Security

Senior Backend Engineer

Senior Machine Learning Engineer

VP of Engineering