Platform & Security Engineer
About the role
This is a senior-level Platform & Security Engineer role based in Colombo with a hybrid work arrangement. The position is responsible for owning the company's cloud platform and security, including infrastructure code, pipelines, and backend code. The engineer will design and manage the cloud environment, implement autoscaling and cost controls, extend security tooling, triage and fix security findings, and enforce best practices in authentication and access. Additional responsibilities include reviewing backend services for scalability, running load tests, setting engineering standards, moving infrastructure to code, building CI/CD pipelines, and managing observability and incident response. The role requires strong experience in platform, DevOps, or SRE roles, with a focus on cloud production systems, infrastructure-as-code, containers, backend code, database performance, security, and clear communication. The company will share full environment details with shortlisted candidates at interview.
Must have
- 4+ years in platform, DevOps, SRE or backend roles, with at least 3 years running production systems on a major cloud provider (Google Cloud preferred).
- Strong infrastructure-as-code and CI/CD skills (for example Terraform and GitHub Actions).
- Containers in production, including image hardening.
- Able to read and change Node.js/TypeScript backend code.
- Relational database performance work: query plans, indexing, connection pooling and replicas.
- Hands-on security work: secrets management, least-privilege access, code, dependency and container scanning, and the OWASP Top 10, especially authorization flaws.
- Load testing and capacity planning, with real numbers to show for it.
- Clear written communication. You’ll write runbooks and explain risk to non-engineers.
- BSc in Computer Science, IT or a related field, or an equivalent professional qualification.
Nice to have
- Web and API security testing tools, including writing custom scanning rules.
- WAF, rate-limiting and bot-protection configuration.
- Message queues and caching at scale.
- Mobile app security, or securing payment integrations.
- Certifications such as Google Professional Cloud Security Engineer, Professional Cloud Architect or CKS.
- Startup experience in consumer platforms or e-commerce.
Technologies
- API Security
- Authentication
- CI/CD
- Cloud Security
- DevOps
- E-commerce
- GCP
- GitHub
- GitHub Actions
- Infrastructure as Code
- Node.js
- Observability
- OWASP
- Performance Testing
- Secrets Management
- Terraform
- TypeScript
- WAF
Highlights
Applicants should send their CV and a short note to hr@mo.lk, describing a scaling or security problem they have solved and its impact. The role is hybrid in Colombo and involves reporting to the CEO and Engineering Lead. Full details of the technical environment are provided at interview.
Jobs across Sri Lanka, watched for you.Colombo, Sri Lanka