Upwind

Cloud security platform (CNAPP) protecting AWS, Azure, GCP and Kubernetes environments. We're expanding our Web UI QA team, where each engineer is embedded in a product team as the module's quality owner.
 

What you'll do:
- Test complex end-to-end flows: cloud onboarding, threat detection, posture, vulnerabilities
- Write and run test cases for UI and API (functional, regression, smoke)
- Build and maintain UI and API autotests (Java, Selenide, REST-assured, JUnit 5)
- Check data with SQL and OpenSearch
- File clear, reproducible bugs and verify the fixes
- Work with developers and PMs from requirements through release
 

Requirements:
- Computer Science degree, or currently in a CS program (final year)
- Strong grasp of testing fundamentals: test design techniques, the bug life cycle
- Java or another OOP language, plus basic algorithms
- HTTP and REST APIs (Postman or similar)
- Basic SQL and Git
- English at Intermediate or above
- Strong drive for self-learning and picking up new technologies quickly
- Flexibility to work extra hours during critical releases
 

Nice to have:
- Selenium/Selenide or Playwright, JUnit or TestNG
- Linux, Docker, Kubernetes basics
- AWS, Azure or GCP basics
- Interest in cybersecurity
 

We offer:
- Hands-on work with a cutting-edge cloud security product
- Mentorship from senior QA engineers and a clear growth path
- A modern stack and real influence on quality

Upwind is a fast-growing cloud security company. Our WebUI QA team owns the quality of the product customers use every day, across AWS, GCP, Azure, Docker and Kubernetes.

Stack: Java, Selenide, REST-assured, JUnit 5, Allure, GitHub Actions, Jira.

Responsibilities

• Test new features manually and via API, up to release sign-off
• Write and maintain UI and API autotests
• Report clear bugs and drive them to verification

Requirements

• 1+ year in test automation
• Solid Java (or another OOP language and readiness to switch)
• Selenium / Selenide / Playwright, REST API testing
• Strong manual testing skills
• Git, CI, DevTools; good written English

Basic understanding required AWS / GCP / Azure, Kubernetes, Docker, SQL

We offer: real ownership, a strong team, modern cloud security product, fast growth.

Who we are looking for: you should be ready to work overtime when needed - release days, urgent customer issues, cross-timezone syncs.

Java · Selenide · AWS / Azure / GCP · Kubernetes · Terraform · Runtime Threat Detection
 

About the role

Upwind is a runtime-powered cloud security platform. We protect customers' cloud environments across AWS, Azure, and GCP — from the moment an account is onboarded, through vulnerability and image scanning, CSPM and compliance, identity and inventory correctness, all the way to runtime threat detection.
 

You will own quality for a set of product areas end to end: writing and running the manual test plans, building and maintaining the UI automation that keeps them from regressing, and being the person who finds the problem before a customer does. You sit inside a feature squad next to the backend and frontend owners, not downstream of them.
 

This is a hands-on role with a real learning curve on the cloud-security domain. We expect you to grow into it, and we will support that.
 

What you'll actually do

Manual testing & test design

• Build test plans for new features — onboarding flows, dashboards, scanners, integrations — and turn them into structured, prioritized test cases (P0/P1/P2) with clear preconditions, steps, and exit criteria.
• Run feature-level manual QA cycles: validate acceptance criteria against the PRD, verify each functional requirement, sign off before go-live.
• Run regression and retest sweeps ahead of releases, and verify fixes on dev before they move forward.
   

Bug reporting

• File bugs that engineers can act on immediately: summary, exact reproduction steps, expected vs actual, impact, environment, and evidence (HTTP requests/responses, Terraform or Helm output, console links, screenshots).
• Triage bug clusters by root cause and link related issues, rather than filing ten tickets for one underlying defect.
• Escalate customer-impacting findings clearly — especially anything that blocks onboarding or produces silent data inconsistency.
   

Automation

• Write and maintain WebUI automated tests in Java + Selenide, extending an existing framework: new test cases, page objects, helpers, test data.
• Grow automation coverage for the areas you test manually, so that manual effort shifts toward exploratory and new-feature work.
• Keep the suite healthy — investigate failures, distinguish real defects from flakiness, and fix the flaky ones.
• Push testability into the product: drive stable data-testid selectors and other conventions instead of depending on CSS classes, DOM structure, or text.
   

Cloud & hands-on environment work

• Set up and tear down test environments yourself: onboard AWS accounts and organizations via CloudFormation and Terraform, onboard Azure tenants and GCP projects, and verify off-boarding actually cleans up.
• Deploy and validate our sensors — the Upwind Operator on EKS via Helm, and host agents on EC2 instances.
• Generate realistic QA workloads and verify the platform detects and displays them correctly.
• Cross-check what the UI shows against the underlying data — backing stores, exports, and reports — to catch cases where the UI and reality disagree.
   

Collaboration

• Work daily with backend and frontend engineers, product managers, and designers inside feature working groups (Slack channels, Figma, Confluence).
• Keep test plans, test cases, and results documented in Jira and Confluence so anyone can pick up the state of a feature.
   

What we're looking for

Must have

• Commercial experience in software QA covering both manual and automated testing.
• Java — confident enough to read, extend, and debug an existing test codebase.
• Hands-on experience with UI test automation (Selenide, Selenium, or a similar WebUI framework). Selenide specifically is a plus, but transferable experience is fine.
• Solid test design fundamentals: equivalence classes, boundary values, negative testing, prioritization, and knowing what not to test.
• Comfort with REST APIs and browser devtools — reading requests, responses, status codes, and payloads to pinpoint whether a bug is frontend, backend, or data.
• Working knowledge of at least one major cloud provider (AWS, Azure, or GCP) — you can navigate a console, understand IAM basics, and follow an onboarding flow.
• Basic Linux and CLI comfort: SSH, systemctl, log reading, running install scripts.
• Git, and experience working in a Jira-based workflow.
• English sufficient for daily written and spoken work with a distributed team.
   

Nice to have

• Kubernetes fundamentals — enough to run kubectl, install a Helm chart, and read pod logs.
• Terraform or CloudFormation exposure.
• Background or genuine interest in cybersecurity: vulnerabilities and CVEs, CSPM, IAM, threat detection.
• SQL or experience querying a data store (e.g. OpenSearch) to verify data independently of the UI.
• CI/CD experience — running suites in a pipeline, reading build failures.
• Experience testing in regulated or compliance-driven environments (FedRAMP, SOC 2, or similar).
   

What matters most to us

• Curiosity about why something broke, not just that it broke. The best bugs on our board come with a diagnosis attached.
• Ownership. You set up your own environments, you chase the answer, you follow the fix through to verification.
• Precision in writing. A vague bug report costs the team a day; a good one saves it.
• Willingness to learn cloud security fast. You don't need to arrive an expert — you do need to want to become one.
  
   

What you'll learn here

Real depth in cloud security across all three major providers, hands-on Kubernetes and infrastructure-as-code, a mature Java automation stack, and what it takes to ship a security platform trusted with production cloud environments.

QA Engineer (Junior-Friendly) — Cloud Security Platform

Java · Selenide · AWS / Azure / GCP · Kubernetes · Terraform

Start here, and go deep

Upwind is a cloud security platform. Companies connect their AWS, Azure and GCP environments to us, and we tell them what's dangerous — vulnerable container images, misconfigured permissions, exposed identities, live attacks in progress.

It's a big product, and nobody arrives knowing it. You'll learn it with us — the cloud, the Kubernetes, the security domain, the automation. That's the deal: you bring the curiosity and the fundamentals, we teach you the rest.

What you'll be working on

Testing features by hand

• Learn a feature area properly, then write test plans for it — onboarding flows, dashboards, scanners, integrations
• Turn plans into clear, prioritized test cases with real steps and expected results
• Check new features against what product actually asked for, and verify fixes before they ship
• Run regression rounds before releases

Writing automation

• Write WebUI tests in Java + Selenide, in a framework that already exists — you'll be adding to it and learning the patterns, not building from zero
• Gradually automate the areas you've been testing manually, so your time moves to more interesting work
• Investigate failing tests: is it a real bug, or is the test unstable? Learn to tell the difference fast

Getting hands-on with cloud

• Set up your own test environments: connect AWS accounts using Terraform and CloudFormation, onboard Azure and GCP projects
• Deploy our sensors onto Kubernetes clusters and Linux servers
• Generate QA workloads and check the platform reacts the way it should
• Compare what the UI shows against the real underlying data — this is where the most interesting bugs hide

Reporting what you find

• Write bug reports engineers can pick up immediately: steps, expected vs actual, impact, environment, and evidence
• Learn to spot when five bugs are really one bug with one cause

What we need from you

• Some commercial QA experience — internship, junior role, or a year or two of manual testing
• Basic Java — you've written and debugged code, and you can read someone else's without panic. You don't need to be a developer.
• Some exposure to test automation. If you've written Selenium or Selenide tests in a course or a small project, that counts.
• Test design fundamentals: equivalence classes, boundary values, negative cases — the ISTQB material, understood rather than memorized
• Curiosity about how things work under the hood: you've opened browser devtools and looked at what requests a page makes
• Basic Linux comfort: you can SSH into a machine and read a log file
• Git and Jira
• English good enough to work in a distributed team every day

Genuinely optional

Cloud experience of any kind · Kubernetes · Terraform · a security course or CTF you did for fun · SQL · CI/CD

If you have none of these, that's fine. If you have one, tell us about it.

What we care about more than your CV

• You want to know why. "It's broken" is where you start, not where you stop.
• You'll set things up yourself rather than waiting for someone to hand you an environment.
• You write clearly. A vague bug report costs the team a day; a good one saves it.
• You want to learn cloud security properly. Not eventually. Now.

What you'll walk away with

Java automation experience in a real production suite. Hands-on AWS, Azure, GCP, Kubernetes and Terraform. A working understanding of how cloud attacks and defenses actually operate.

That combination takes most people years to assemble. You'll build it here, with people who'll teach you.

Bring the curiosity. Apply.

Why this role is worth your next few years

Most QA jobs teach you one product and one process. You learn the checklist, and two years later the checklist is still all you know.

This one is different. You'll work across cloud security on AWS, Azure and GCP — deploying Kubernetes clusters, running infrastructure-as-code, testing threat detection, and writing the Java automation that holds it together. That isn't one skill. It's the stack the entire market is hiring for, learned properly, alongside people who will actually teach you.

You'll start with support and a defined feature area. Within a few months you'll be running that area yourself.

What you'll be doing

Testing and test design

• Own test plans for your feature areas — onboarding flows, dashboards, scanners, integrations — and turn them into prioritized test cases with real exit criteria
• Run feature QA cycles: validate acceptance criteria against the PRD, verify each requirement, sign off before release
• Run regression sweeps and verify fixes before they move forward

Automation

• Write and maintain WebUI tests in Java + Selenide, extending a framework that's already there — you're not starting from a blank file, but you will be shaping it
• Automate the areas you test by hand, so your manual time goes to exploratory and new-feature work
• Keep the suite healthy: investigate failures, separate real defects from flakiness, and fix the flaky ones properly
• Start contributing to how we test, not just what we test — stable selectors, reusable helpers, better test data

Hands-on cloud work

• Set up your own environments: onboard AWS accounts via Terraform and CloudFormation, Azure tenants, GCP projects, and verify off-boarding actually cleans up
• Deploy our sensors on EKS with Helm and on EC2 hosts
• Generate QA workloads and confirm the platform detects and displays them correctly
• Cross-check the UI against the underlying data — where the most interesting bugs live

Working with people

• Daily contact with backend and frontend engineers, PMs and designers inside your feature squad
• Keep test plans, cases and results documented in Jira and Confluence so anyone can pick up where you left off

What you need to bring

• Commercial QA experience covering both manual and automated testing
• Java — enough to read, extend and debug an existing test codebase confidently
• Hands-on UI automation you've done on a real project (Selenide, Selenium, or similar — transferable experience is fine)
• Test design fundamentals, and the judgment to know what not to test
• REST APIs and browser devtools: enough to tell whether a bug is frontend, backend, or data
• Working knowledge of at least one major cloud provider — console, IAM basics, onboarding flows
• Basic Linux and CLI: SSH, systemctl, reading logs
• Git and Jira
• English for daily work with a distributed team

Nice to have — not required

Kubernetes basics · Terraform or CloudFormation · interest in cybersecurity (CVEs, CSPM, IAM) · SQL or OpenSearch · CI/CD · regulated environments like FedRAMP or SOC 2

What actually matters to us

• Curiosity about why something broke. The best bugs on our board come with a diagnosis attached.
• Ownership. You set up your own environments, chase the answer, and follow the fix through to verification.
• Precision in writing. A vague bug report costs the team a day; a good one saves it.
• Willingness to learn fast. You don't need to arrive a cloud security expert. You need to want to become one.

What you get out of it

Real mentorship from engineers who know this domain cold. Depth in cloud security across all three major providers, hands-on Kubernetes and infrastructure-as-code, and a mature Java automation stack.

You'll absorb in months what most people spend years collecting — and come out the other side as an engineer nobody wants to lose.

Curious? Apply.