Security Engineer, Infrastructure Security

Responsibilities

Partner across teams

• Work with the DevOps and Infrastructure teams to securely roll out AI tooling across our infrastructure, securing the deployment path, service-to-service communication, and the network boundaries around these workloads.
• Partner with the Networking team on data-center and cloud network security: NSGs, segmentation, VPC structure, private connectivity, and egress policy.
• Enable the Detection & Response team by making every environment produce the telemetry they need, and provide environment access and context during incidents.

Authentication / Authorization

• Own multi-cloud authentication and authorization: centralized SSO for human identities, workload identity and federated credentials for machine identities, and consistent, least-privilege access policy across cloud providers.
• Extend that identity model to on-prem and neocloud environments, including hardware-rooted machine identity so all our infrastructure inherits the same authN/authZ guarantees as our cloud backends.
• Drive the move away from long-lived reusable credentials toward sealed, short-lived, workload-scoped authentication, and build just-in-time, time-bound elevated access.

Visibility

• Measure posture: build the tooling and pipelines for asset and identity inventory, configuration drift detection, and coverage metrics across cloud, on-prem, and neocloud environments.
• Turn misconfiguration and vulnerability findings into tracked, closed-loop remediation across every environment class.

Networking

• Advance our zero-trust networking model as the universal access layer: identity-aware, posture-gated access to internal services with no public IPs and no cross-environment traffic outside the overlay.
• Design and enforce egress controls so workloads can't make arbitrary outbound calls.
• Define the secure-by-default networking patterns other teams build on top of, so segmentation and access rules are versioned, reviewed, and auditable rather than hand-configured.

Requirements

• Experience and security knowledge of one or more domains and technologies: Kubernetes, containers, service mesh, networking, operating system internals, authentication/authorization protocols, and cloud security tools.
• Experience developing and deploying services in multi-cloud environments, preferably familiar with a multi-cloud infrastructure spanning at least two of the three: Azure, AWS, or Google Cloud Platform.
• 6+ years of security / software development experience.
• Strong software engineering skills (not scripting or automation) skills in C/C++, Rust, Golang, Python or similar.
• Passion for learning and helping others.
• Excellent verbal and written communication skills, with high attention to detail.
• BS/BA in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field

Preferred

• Familiarity with zero-trust networking, posture-based access control, and egress/segmentation design.
• Hands-on with workload identity / federated credentials, and secrets management.
• Experience with delivering security controls as reviewed, versioned code.
• Familiarity with securing AI/ML tool usage across infrastructure.
• Track record of building self-service security tooling and paved paths that scale to a fast-moving engineering org.
• Experience securing on-prem or neocloud alongside public cloud.

Bonus Qualifications

The US base salary range for this full-time position is between $150,000 - $250,000 annually.

The pay offered for this position may vary based on several individual factors, including job-related knowledge, skills, and experience. The total compensation package may also include additional components/benefits depending on the specific role. This information will be shared if an employment offer is extended.