Platform Security Engineer

Branch Overview

Branch is a leading AI-powered lending fintech with 50M+ downloads across India and Africa. We use alternative data and machine learning to expand financial access for millions of people traditionally excluded from the formal financial system. Founded by the former CEO of Kiva.org and backed by leading investors including Andreessen Horowitz, Visa, and the IFC, Branch combines mission-driven impact with world-class technology and scale.

In India, Branch operates as a regulated digital lending institution and Middle Layer NBFC, building trusted and accessible financial products for millions of customers across the country. Our 250+ member India team is growing rapidly and works across technology, data science, risk, product, and operations to solve high-impact problems at scale. 

Certified as a Great Place to Work in 2025, Branch offers the opportunity to build meaningful careers while shaping the future of inclusive fintech in one of the world’s fastest-growing digital economies.

About Role

We are seeking a hands-on Cloud Security Engineer to help secure the infrastructure and platforms that power our global Fin-Tech systems. In this role, you will work at the intersection of cloud infrastructure, security engineering, and DevSecOps to identify attack surfaces, strengthen security guardrails, and embed security directly into our engineering workflows. You will focus on securing our AWS environments, container platforms, and deployment pipelines while helping engineers design systems that are resilient to real-world threats.
You will collaborate closely with platform engineers, DevOps teams, and application developers to proactively identify risks, automate security controls, and improve the overall security posture of our systems. This role requires someone who can think like an attacker but build like an engineer. You are someone who enjoys identifying weaknesses, designing preventative controls, and building security automation that scales with the platform.
You will work closely with our engineering teams across India, the United States, Nigeria, and Kenya, collaborating across time zones to help build and secure a world-class Fin-Tech platform serving millions of users globally.
As a company, we are passionate about our customers, fearless in the face of barriers, and driven by data. As an engineering team, we value bottom-up innovation and decentralized decision-making. We believe the best ideas can come from anyone in the company. We work hard to create an environment where everyone feels empowered to propose solutions, challenge assumptions, and drive meaningful impact. We are looking for individuals who thrive in a fast-moving, innovative, and customer-focused setting and want to contribute to building scalable, reliable, and efficient backend systems.
As a company, we are passionate about our customers, fearless in the face of barriers, and driven by data. As an engineering team, we value bottom-up innovation and decentralized decision-making: We believe the best ideas can come from anyone in the company, and we are working hard to create an environment where everyone feels empowered to propose solutions to the challenges we face. We are looking for individuals who thrive in a fast-moving, innovative, and customer-focused setting.

Responsibilities

• Identify and secure attack surfaces across our AWS infrastructure, Kubernetes clusters, and internal platforms by proactively assessing misconfigurations, access risks, and exposed services.
• Design and implement preventative cloud security guardrails including IAM hardening, network controls, secrets management, and infrastructure security best practices.
• Conduct security design reviews for new services and infrastructure changes to identify architectural risks before systems reach production.
• Build and integrate security checks directly into CI/CD pipelines to enforce automated scanning for vulnerabilities, container images, infrastructure configurations, and application dependencies.
• Develop automation and internal tooling to detect, prevent, and remediate security issues such as leaked secrets, excessive permissions, insecure configurations, and vulnerable dependencies.
• Perform threat modeling and adversarial analysis of infrastructure and application systems to identify realistic attack paths and improve system defenses.
• Improve visibility into the security posture of our systems through monitoring, logging, and security signal generation across cloud infrastructure and workloads.
• Investigate security incidents and vulnerabilities, perform root cause analysis, and implement long-term fixes to prevent recurrence.
• Collaborate closely with platform, infrastructure, and application engineering teams to ensure security is embedded in development workflows and infrastructure design.
• Contribute to building scalable security practices including vulnerability management processes, security automation frameworks, and infrastructure security standards.

Qualifications

• 4+ years of experience in cloud security, DevSecOps, security engineering, or related roles involving infrastructure and application security.
• Strong understanding of applied cryptography and ability to choose the right security tools, techniques, and approach for securing systems from a variety of threats.
• Strong hands-on experience securing AWS environments including IAM policies, networking controls, access management, logging, and infrastructure hardening.
• Practical experience working with Kubernetes and containerized environments, including securing container images, workloads, and cluster configurations.
• Experience integrating security controls into CI/CD pipelines and development workflows, including automated vulnerability scanning and dependency security checks.
• Ability to write automation and security tooling using scripting or programming languages such as Python, Go, or similar.
• Familiarity with Infrastructure-as-Code tools such as Terraform and an understanding of securing infrastructure configurations and deployment pipelines.
• Experience identifying and remediating cloud security risks such as excessive IAM permissions, exposed services, insecure secrets management, and vulnerable infrastructure components.
• Understanding of common cloud and application security threats including privilege escalation, credential leakage, network exposure, and supply chain vulnerabilities.
• Strong problem-solving mindset with the ability to think adversarially about systems and proactively identify potential attack paths.
• Excellent collaboration and communication skills (verbal as well as written) with the ability to work closely with engineering teams and other stakeholders to improve security posture without slowing development velocity.
• Bonus experience includes security research, penetration testing, bug bounty participation, building internal security tooling, or contributions to security-focused open-source projects.
• Bonus abilities include ability to lead and mentor a team, and ability to drive complex projects spanning code bases, systems, and people.

Core Engineering Expectations

The following describes the traits we expect in our engineers, and reflects instincts developed over years of shipping real software. If you are early in your career, we do not expect you to demonstrate all of it yet — but we do expect a genuine appreciation for why these qualities matter, an honest sense of where you stand against them, and the drive to close the gap.

Engineering craft and judgment

• You balance technical excellence with business and consumer needs. You research and seek opinions to identify the best solution for a problem, not just the first one that comes to mind. You intentionally weigh technical debt, ensuring it is paid down before it compounds.
• You have a deep understanding of web fundamentals, data modeling, and distributed systems. You apply proven design patterns to build modular, scalable solutions and ensure that security, performance, and observability are baked into your work from the outset.
• You use automated testing as both a blueprint for clean architecture and a safety net for refactoring. You believe that well-designed code should be inherently testable, and you hold all contributions, whether human or AI generated, to the same standard of quality and maintainability.
• You are comfortable navigating and evaluating unfamiliar codebases. You can integrate into and evolve existing architectures with care, researching thoroughly and seeking peer feedback to ensure your changes improve the system without breaking it.
• You understand the full software development lifecycle. You can break down ambiguous projects into granular, estimable tasks that can be delegated effectively, ensuring a predictable and transparent path to delivery. You treat your delivery commitments as something the rest of the team plans against.
• You consider the ripple effects of your work. You think critically about how your choices impact the end user, the business, and the team’s future velocity, and you have the drive to master the domain knowledge required to make those calls.
• You partner with product, design, and other functions to shape the work, not just receive it. You push back when the spec is wrong, ask the question that reframes the problem, and share ownership of whether the thing was worth building in the first place.

AI proficiency

• AI fluency is table stakes. You use AI to amplify your logic, not to replace it. You decompose ambiguous problems into clear steps and dependencies before prompting, ensuring you drive the architecture rather than allowing the AI to improvise a structure that compounds errors at high speed.
• You hold AI-generated output to the same rigorous standards as human written code. You have the intuition to catch hallucinations of correctness, e.g. elegant looking code that fails subtly or tests that pass without actually asserting logic, and you take total accountability for the final implementation. Your trust is calibrated through experience; you can clearly articulate your technical reasoning whenever you choose to override an AI’s suggestion.
• You manage tool context deliberately to avoid "model noise" and recognize the point of diminishing returns. You know exactly when to leverage a prompt to accelerate your workflow and when to step back to solve a high-complexity problem through deep, independent thought.
• You proactively mitigate risks inherent to agentic workflows, including prompt injection, data leakage, and secret management. You treat AI-era security as a fundamental part of the engineering process, ensuring that "agentic" doesn't mean "unsecured."
• You aggressively automate the mundane so your attention is reserved for the complex logic and design decisions that actually need a human.
• You stay current with the evolving AI landscape and understand the underlying mechanics of the models and tools you use. You continuously raise your own productivity ceiling as the tools improve.

Operating principles

• You make high-velocity, high-quality decisions. You move fast where the cost of being wrong is low and reversible, slow down where it isn't, and can articulate which mode you're in and why.
• You are highly entrepreneurial and manage your own time, energy, and quality without oversight. You take the initiative to solve problems before they arise; nobody has to ask you twice, and often, nobody has to ask at all.
• You are a high-velocity learner who handles setbacks without losing momentum. You possess the grit to keep moving when things go sideways and the judgment to know exactly when to pull in help to stay on track.
• You have an uncompromising attention to detail. You catch the inconsistent behavior, the edge case bug, and the green test suite that doesn't actually verify anything, maintaining a high bar for the small things that define quality.
• You simplify the complex. You write with the clarity of someone who expects to be read and ask the sharp, uncomfortable questions that often reveal hidden project risks.
• You treat engineering as a team sport. You make those around you better through candid, helpful feedback, active listening, and a genuine commitment to helping your peers grow.
• You're intellectually honest. You change your mind when you’re wrong, credit others when they’re right, and never defend a position or a design just because it’s yours.
• You operate with integrity. You make the right call when no one is watching, raise concerns early when something feels off, and treat the trust placed in you — by users, teammates, and the business — as something to be earned every day.
• You own what you ship. Architecting and writing the code is half the job. Testing, monitoring, documenting, and being on the hook when it breaks is the other half.
• You bring discipline to how you work with others. You communicate in structured, async-friendly ways, keep your calendar and commitments reliable, and show up for shared responsibilities and rituals that keep the team functioning.

Benefits of Joining

• Competitive salary and equity package
• Fast-paced, collaborative, and high-autonomy work culture
• Hybrid work setup designed for flexibility and work-life balance
• Fully paid group medical insurance and personal accident insurance
• Generous paid time off, plus company-declared public holidays
• Fully paid parental leave for fathers and non-birthing parents (12 weeks), in addition to 26 weeks of statutory maternity leave
• Monthly WFH stipend, along with a one-time home office setup budget
• $500 annual professional development budget
• Quarterly social meet-ups and sponsored monthly team lunches

We’re looking for more than just qualifications --  if you’re unsure that you meet the criteria but identify with our vision of providing equal opportunity to everyone to access financial services, please do not hesitate to apply!

Branch International is an Equal Opportunity Employer. The company does not and will not discriminate in employment on any basis prohibited by applicable law.