About Amartha
Amartha is a technology company focused on creating shared prosperity by developing digital financial solutions for the grassroots economy. Founded in 2010 as a microfinance institution, Amartha connects rural, women-led micro-enterprises with affordable capital. Amartha is expanding as a tech company, building a microfinance ecosystem that connects to the growing digital economy through capital, investment, and payment services. By boosting the competitiveness of micro and small entrepreneurs, Amartha empowers women-led MSMEs, creates jobs, and fosters inclusive economic growth.
Our Empowered to Grow culture guides how we work together. We Focus on Clarity, Take the Lead, and Grow Impact, empowering our people to take ownership and create meaningful, lasting impact.
About the role
Amartha is an Indonesian fintech group that provides financial services to micro-entrepreneurs through several licensed entities in lending, payments, and related services. Our production platform runs on Google Cloud and Kubernetes, and our security team is building the controls, detection, and automation that a regulated lender needs at that scale.
We are looking for a Senior Security Engineer to own cloud and platform security engineering. You will run the controls that detect and prevent misconfiguration and intrusion across our cloud and container estate, respond to what our detection stack surfaces, and turn manual security infrastructure into code. You will work alongside DevOps and platform engineering, and your work feeds directly into our ISO 27001 and regulator audit evidence.
This is a hands-on individual contributor role with a wide mandate. You will be the senior voice on cloud security in the team, and we expect you to set the technical direction for it rather than wait for a backlog.
What you will do
Own container and cloud runtime security: workload isolation, Kubernetes hardening, and runtime threat detection.
Run and extend automated benchmark and configuration scanning across our cloud platform and productivity suite, and act on what it finds.
Build shift-left security into CI/CD: infrastructure-as-code scanning and misconfiguration gates before deployment.
Bring the security team's own cloud estate under infrastructure as code. Provisioning is manual and drift-prone today, and ending that is a named deliverable of this role.
Build and run the deployment pipeline for our security tooling, so security infrastructure ships the same way the product does.
Own the SIEM platform end to end: network isolation, version currency, configuration management, and detection coverage across critical workloads.
Respond to and review security alerts, tune detection rules, and cut false positives.
Manage edge and perimeter security: web application firewall rules, DNS and traffic visibility, and security event retention.
Manage the platform and console access paths that sit with security engineering.
Document what you build, to the standard where another engineer can operate it without you. Continuity is a measured outcome of this role, not a nice-to-have.
Share the information security on-call rotation, and help us establish it.
Produce the control evidence our auditors and regulators ask for, with the GRC team.
What you bring
5 or more years in security engineering, infrastructure engineering, or SRE, with at least 3 years focused on cloud and container security.
Hands-on depth in public cloud and Kubernetes security: identity and access management, RBAC, workload identity, network policy, admission control, runtime detection, and secret management. Google Cloud is our primary platform.
Production experience with a SIEM, including deployment, detection rule authoring, and alert triage.
Infrastructure as code in practice, not in theory: reusable modules, state management, and deployment pipelines you built and operated yourself.
Experience embedding security scanning into CI/CD, such as infrastructure-as-code scanning, static…