Upwind

Cloud Security · Runtime Threat Detection · Java · Selenide · Kubernetes · Terraform · Multi-Cloud

Every bug you find is one an attacker doesn't get to use. At this level, every bug you prevent is worth ten of them.
 

The stakes

Upwind is a runtime-powered cloud security platform. Our customers hand us their production cloud environments — AWS, Azure, GCP — and trust us to catch what's wrong: vulnerabilities, misconfigurations, exposed identities, live attacks in progress.

When a dashboard renders empty while CVEs exist in the data, a customer believes they're clean when they're not. When onboarding silently half-fails, an account goes unmonitored. When a detection fires against the wrong resource, an incident responder chases the wrong host.

Those aren't cosmetic defects. That's the line between a security product and a security theater product. We're hiring someone senior enough to hold that line across the platform, not just inside one feature.
 

What you'll own

Test strategy across product areas — cloud onboarding, vulnerability and image scanning, CSPM and compliance, inventory and identity correctness, runtime threat detection. You decide what gets tested, at what depth, and where the real risk sits. You'll be the person other engineers ask before shipping.

Automation architecture, not just test cases. Own the design and direction of our Java + Selenide WebUI framework: structure, patterns, page object design, test data strategy, parallelization, reporting, CI integration. Decide what belongs in UI automation and what belongs at the API layer — and say no to UI tests that shouldn't exist.
 

Testability as an engineering problem. Drive standards into the product itself — stable data-testid conventions, deterministic test hooks, seedable environments — so that a frontend refactor stops invalidating hundreds of tests that found no defect. This means writing proposals, winning agreement from frontend and backend leads, and seeing adoption through.
 

Release quality gates. Define exit criteria and risk-based prioritization for releases. Run and sign off regression cycles. Make the call on whether something ships — and be able to defend it with evidence.
 

Deep infrastructure work. Onboard AWS accounts and organizations via CloudFormation and Terraform, Azure tenants, GCP projects — and verify off-boarding genuinely cleans up. Deploy the Upwind Operator on EKS via Helm and host agents on EC2. Design and generate QA workloads that exercise detection paths realistically.
 

Data integrity at the system level. Cross-check the UI against backing stores, exports and generated reports. Trace a discrepancy through the stack — frontend, API, pipeline, store — and arrive with a diagnosis, not a question.
 

Raising the people around you. Mentor less experienced QA engineers, review their test designs and automation code, and set the standard for what a bug report and a test plan look like here.
 

What we need from you
 

Must have

• Substantial commercial QA experience with genuine depth in both manual testing and automation
• Strong Java — you design and refactor test code, not just add to it; you understand why the framework is built the way it is and can argue for changing it
• Proven ownership of a UI automation framework in production (Selenide, Selenium, or equivalent) — including stability, runtime, and maintenance cost as things you actively managed
• Test strategy and risk-based prioritization at product-area scale, not just test-case level
• Strong API testing skills and the ability to debug across frontend, backend, pipeline and data store
• Real working experience with at least one major cloud provider: IAM, resource models, onboarding and permission flows
• Kubernetes in practice — kubectl, Helm, reading pod logs, understanding what a broken deployment is telling you
• CI/CD: suites running in a pipeline, and you own why they're green
• Git, Jira, Confluence; confident written and spoken English in a distributed team
   

Strongly preferred

• Terraform or CloudFormation, hands-on
• Cybersecurity domain knowledge — CVEs and vulnerability management, CSPM, IAM, threat detection
• SQL or OpenSearch for independent verification of what the UI claims
• Experience in regulated or compliance-driven environments (FedRAMP, SOC 2)
• Track record of mentoring QA engineers
   

Who does well here

Someone who can't leave a question alone, and who has enough experience to know which questions are worth the day. Who sets up their own environments, chases root cause through the stack, and follows a fix to verification.
 

Someone whose bug reports get picked up immediately because they arrive with a diagnosis attached — and whose test strategies mean fewer of those reports need writing at all.
 

How we work

Inside feature squads, next to the backend and frontend owners — Slack working groups, Figma, Confluence. Senior QA here has real influence on what gets built and how, not a gate at the end of the pipeline.
 

Let's talk.

Why this role is worth your next few years

Most QA jobs teach you one product and one process. You learn the checklist, and two years later the checklist is still all you know.

This one is different. You'll work across cloud security on AWS, Azure and GCP — deploying Kubernetes clusters, running infrastructure-as-code, testing threat detection, and writing the Java automation that holds it together. That isn't one skill. It's the stack the entire market is hiring for, learned properly, alongside people who will actually teach you.

You'll start with support and a defined feature area. Within a few months you'll be running that area yourself.

What you'll be doing

Testing and test design

• Own test plans for your feature areas — onboarding flows, dashboards, scanners, integrations — and turn them into prioritized test cases with real exit criteria
• Run feature QA cycles: validate acceptance criteria against the PRD, verify each requirement, sign off before release
• Run regression sweeps and verify fixes before they move forward

Automation

• Write and maintain WebUI tests in Java + Selenide, extending a framework that's already there — you're not starting from a blank file, but you will be shaping it
• Automate the areas you test by hand, so your manual time goes to exploratory and new-feature work
• Keep the suite healthy: investigate failures, separate real defects from flakiness, and fix the flaky ones properly
• Start contributing to how we test, not just what we test — stable selectors, reusable helpers, better test data

Hands-on cloud work

• Set up your own environments: onboard AWS accounts via Terraform and CloudFormation, Azure tenants, GCP projects, and verify off-boarding actually cleans up
• Deploy our sensors on EKS with Helm and on EC2 hosts
• Generate QA workloads and confirm the platform detects and displays them correctly
• Cross-check the UI against the underlying data — where the most interesting bugs live

Working with people

• Daily contact with backend and frontend engineers, PMs and designers inside your feature squad
• Keep test plans, cases and results documented in Jira and Confluence so anyone can pick up where you left off

What you need to bring

• Commercial QA experience covering both manual and automated testing
• Java — enough to read, extend and debug an existing test codebase confidently
• Hands-on UI automation you've done on a real project (Selenide, Selenium, or similar — transferable experience is fine)
• Test design fundamentals, and the judgment to know what not to test
• REST APIs and browser devtools: enough to tell whether a bug is frontend, backend, or data
• Working knowledge of at least one major cloud provider — console, IAM basics, onboarding flows
• Basic Linux and CLI: SSH, systemctl, reading logs
• Git and Jira
• English for daily work with a distributed team

Nice to have — not required

Kubernetes basics · Terraform or CloudFormation · interest in cybersecurity (CVEs, CSPM, IAM) · SQL or OpenSearch · CI/CD · regulated environments like FedRAMP or SOC 2

What actually matters to us

• Curiosity about why something broke. The best bugs on our board come with a diagnosis attached.
• Ownership. You set up your own environments, chase the answer, and follow the fix through to verification.
• Precision in writing. A vague bug report costs the team a day; a good one saves it.
• Willingness to learn fast. You don't need to arrive a cloud security expert. You need to want to become one.

What you get out of it

Real mentorship from engineers who know this domain cold. Depth in cloud security across all three major providers, hands-on Kubernetes and infrastructure-as-code, and a mature Java automation stack.

You'll absorb in months what most people spend years collecting — and come out the other side as an engineer nobody wants to lose.

Curious? Apply.

QA Engineer (Junior-Friendly) — Cloud Security Platform

Java · Selenide · AWS / Azure / GCP · Kubernetes · Terraform

Start here, and go deep

Upwind is a cloud security platform. Companies connect their AWS, Azure and GCP environments to us, and we tell them what's dangerous — vulnerable container images, misconfigured permissions, exposed identities, live attacks in progress.

It's a big product, and nobody arrives knowing it. You'll learn it with us — the cloud, the Kubernetes, the security domain, the automation. That's the deal: you bring the curiosity and the fundamentals, we teach you the rest.

What you'll be working on

Testing features by hand

• Learn a feature area properly, then write test plans for it — onboarding flows, dashboards, scanners, integrations
• Turn plans into clear, prioritized test cases with real steps and expected results
• Check new features against what product actually asked for, and verify fixes before they ship
• Run regression rounds before releases

Writing automation

• Write WebUI tests in Java + Selenide, in a framework that already exists — you'll be adding to it and learning the patterns, not building from zero
• Gradually automate the areas you've been testing manually, so your time moves to more interesting work
• Investigate failing tests: is it a real bug, or is the test unstable? Learn to tell the difference fast

Getting hands-on with cloud

• Set up your own test environments: connect AWS accounts using Terraform and CloudFormation, onboard Azure and GCP projects
• Deploy our sensors onto Kubernetes clusters and Linux servers
• Generate QA workloads and check the platform reacts the way it should
• Compare what the UI shows against the real underlying data — this is where the most interesting bugs hide

Reporting what you find

• Write bug reports engineers can pick up immediately: steps, expected vs actual, impact, environment, and evidence
• Learn to spot when five bugs are really one bug with one cause

What we need from you

• Some commercial QA experience — internship, junior role, or a year or two of manual testing
• Basic Java — you've written and debugged code, and you can read someone else's without panic. You don't need to be a developer.
• Some exposure to test automation. If you've written Selenium or Selenide tests in a course or a small project, that counts.
• Test design fundamentals: equivalence classes, boundary values, negative cases — the ISTQB material, understood rather than memorized
• Curiosity about how things work under the hood: you've opened browser devtools and looked at what requests a page makes
• Basic Linux comfort: you can SSH into a machine and read a log file
• Git and Jira
• English good enough to work in a distributed team every day

Genuinely optional

Cloud experience of any kind · Kubernetes · Terraform · a security course or CTF you did for fun · SQL · CI/CD

If you have none of these, that's fine. If you have one, tell us about it.

What we care about more than your CV

• You want to know why. "It's broken" is where you start, not where you stop.
• You'll set things up yourself rather than waiting for someone to hand you an environment.
• You write clearly. A vague bug report costs the team a day; a good one saves it.
• You want to learn cloud security properly. Not eventually. Now.

What you'll walk away with

Java automation experience in a real production suite. Hands-on AWS, Azure, GCP, Kubernetes and Terraform. A working understanding of how cloud attacks and defenses actually operate.

That combination takes most people years to assemble. You'll build it here, with people who'll teach you.

Bring the curiosity. Apply.

Java · Selenide · AWS / Azure / GCP · Kubernetes · Terraform · Runtime Threat Detection
 

About the role

Upwind is a runtime-powered cloud security platform. We protect customers' cloud environments across AWS, Azure, and GCP — from the moment an account is onboarded, through vulnerability and image scanning, CSPM and compliance, identity and inventory correctness, all the way to runtime threat detection.
 

You will own quality for a set of product areas end to end: writing and running the manual test plans, building and maintaining the UI automation that keeps them from regressing, and being the person who finds the problem before a customer does. You sit inside a feature squad next to the backend and frontend owners, not downstream of them.
 

This is a hands-on role with a real learning curve on the cloud-security domain. We expect you to grow into it, and we will support that.
 

What you'll actually do

Manual testing & test design

• Build test plans for new features — onboarding flows, dashboards, scanners, integrations — and turn them into structured, prioritized test cases (P0/P1/P2) with clear preconditions, steps, and exit criteria.
• Run feature-level manual QA cycles: validate acceptance criteria against the PRD, verify each functional requirement, sign off before go-live.
• Run regression and retest sweeps ahead of releases, and verify fixes on dev before they move forward.
   

Bug reporting

• File bugs that engineers can act on immediately: summary, exact reproduction steps, expected vs actual, impact, environment, and evidence (HTTP requests/responses, Terraform or Helm output, console links, screenshots).
• Triage bug clusters by root cause and link related issues, rather than filing ten tickets for one underlying defect.
• Escalate customer-impacting findings clearly — especially anything that blocks onboarding or produces silent data inconsistency.
   

Automation

• Write and maintain WebUI automated tests in Java + Selenide, extending an existing framework: new test cases, page objects, helpers, test data.
• Grow automation coverage for the areas you test manually, so that manual effort shifts toward exploratory and new-feature work.
• Keep the suite healthy — investigate failures, distinguish real defects from flakiness, and fix the flaky ones.
• Push testability into the product: drive stable data-testid selectors and other conventions instead of depending on CSS classes, DOM structure, or text.
   

Cloud & hands-on environment work

• Set up and tear down test environments yourself: onboard AWS accounts and organizations via CloudFormation and Terraform, onboard Azure tenants and GCP projects, and verify off-boarding actually cleans up.
• Deploy and validate our sensors — the Upwind Operator on EKS via Helm, and host agents on EC2 instances.
• Generate realistic QA workloads and verify the platform detects and displays them correctly.
• Cross-check what the UI shows against the underlying data — backing stores, exports, and reports — to catch cases where the UI and reality disagree.
   

Collaboration

• Work daily with backend and frontend engineers, product managers, and designers inside feature working groups (Slack channels, Figma, Confluence).
• Keep test plans, test cases, and results documented in Jira and Confluence so anyone can pick up the state of a feature.
   

What we're looking for

Must have

• Commercial experience in software QA covering both manual and automated testing.
• Java — confident enough to read, extend, and debug an existing test codebase.
• Hands-on experience with UI test automation (Selenide, Selenium, or a similar WebUI framework). Selenide specifically is a plus, but transferable experience is fine.
• Solid test design fundamentals: equivalence classes, boundary values, negative testing, prioritization, and knowing what not to test.
• Comfort with REST APIs and browser devtools — reading requests, responses, status codes, and payloads to pinpoint whether a bug is frontend, backend, or data.
• Working knowledge of at least one major cloud provider (AWS, Azure, or GCP) — you can navigate a console, understand IAM basics, and follow an onboarding flow.
• Basic Linux and CLI comfort: SSH, systemctl, log reading, running install scripts.
• Git, and experience working in a Jira-based workflow.
• English sufficient for daily written and spoken work with a distributed team.
   

Nice to have

• Kubernetes fundamentals — enough to run kubectl, install a Helm chart, and read pod logs.
• Terraform or CloudFormation exposure.
• Background or genuine interest in cybersecurity: vulnerabilities and CVEs, CSPM, IAM, threat detection.
• SQL or experience querying a data store (e.g. OpenSearch) to verify data independently of the UI.
• CI/CD experience — running suites in a pipeline, reading build failures.
• Experience testing in regulated or compliance-driven environments (FedRAMP, SOC 2, or similar).
   

What matters most to us

• Curiosity about why something broke, not just that it broke. The best bugs on our board come with a diagnosis attached.
• Ownership. You set up your own environments, you chase the answer, you follow the fix through to verification.
• Precision in writing. A vague bug report costs the team a day; a good one saves it.
• Willingness to learn cloud security fast. You don't need to arrive an expert — you do need to want to become one.
  
   

What you'll learn here

Real depth in cloud security across all three major providers, hands-on Kubernetes and infrastructure-as-code, a mature Java automation stack, and what it takes to ship a security platform trusted with production cloud environments.