Platform & Security Engineer

About the role

Platform & Security Engineer · Full-time · Colombo (hybrid) · Senior

We’re hiring a senior engineer to own our cloud platform and security end to end: how it runs, how it scales and how it stays secure. This is a hands-on role. You’ll write infrastructure code, pipelines and backend code yourself, and report to the CEO and the Engineering Lead.

Scaling and security carry equal weight. Full details of our environment are shared with shortlisted candidates at interview.

What you’ll own

1. Cloud platform and scalability

• Design and run our cloud environment: projects, access management, networking, compute, managed databases, caching and messaging.
• Set up autoscaling, connection pooling, caching and queue-based workloads so the platform handles sudden traffic spikes.
• Keep cloud costs visible through budgets, rightsizing and capacity planning.

1. Security tooling and hardening

• Own and extend our security tooling across code, pipelines, cloud, edge, APIs and mobile apps, and run it as part of everyday engineering.
• Triage findings, fix the critical ones yourself and coach engineers through the rest.
• Harden authentication, sessions, integrations and transaction flows against fraud and abuse.
• Enforce least-privilege access, strong authentication and proper secrets management across the team.

1. Code and architecture scalability

• Review backend services for scaling problems such as inefficient queries, missing indexes and slow synchronous work.
• Run load tests, find the breaking points and fix them in code alongside the backend team.
• Set engineering standards for service boundaries, async messaging, idempotency and database migrations.

1. CI/CD and infrastructure as code

• Move all infrastructure into code, with reviewed changes and no manual changes in the console.
• Build CI/CD pipelines covering build, test, security gates, staging, production and rollback.

1. Observability and incident response

• Run logging, monitoring and error tracking. Define SLOs, alerts and security detections.
• Own backups, disaster recovery drills and the incident response runbook, and take part in a light on-call rota.

What we’re looking for

Must have

• 4+ years in platform, DevOps, SRE or backend roles, with at least 3 years running production systems on a major cloud provider (Google Cloud preferred).
• Strong infrastructure-as-code and CI/CD skills (for example Terraform and GitHub Actions).
• Containers in production, including image hardening.
• Able to read and change Node.js/TypeScript backend code.
• Relational database performance work: query plans, indexing, connection pooling and replicas.
• Hands-on security work: secrets management, least-privilege access, code, dependency and container scanning, and the OWASP Top 10, especially authorization flaws.
• Load testing and capacity planning, with real numbers to show for it.
• Clear written communication. You’ll write runbooks and explain risk to non-engineers.
• BSc in Computer Science, IT or a related field, or an equivalent professional qualification.

Nice to have

• Web and API security testing tools, including writing custom scanning rules.
• WAF, rate-limiting and bot-protection configuration.
• Message queues and caching at scale.
• Mobile app security, or securing payment integrations.
• Certifications such as Google Professional Cloud Security Engineer, Professional Cloud Architect or CKS.
• Startup experience in consumer platforms or e-commerce.

How to apply

Send your CV and a short note to . In your note, tell us about one scaling or security problem you found and fixed, and what difference it made.