Senior Security Engineer, Infrastructure Security

Infrastructure Security Architecture: Review infrastructure proposals and technical designs across engineering and business teams, identify security risks, and recommend practical improvements. Develop security architecture proposals and guide teams toward secure implementation through constructive collaboration. AI-Powered Security Automation: Build, evaluate, and maintain AI agents used for architecture reviews, security triage, investigations, and automated workflows. Help design and operate secure, observable, and sandboxed infrastructure for these agents. Threat Detection and Incident Response: Lead investigations into cloud and infrastructure security alerts and incidents, coordinating with application security and incident response teams when issues span multiple security domains. Identify root causes, assess potential impact, and drive incidents through resolution. Identity and Access Management: Strengthen identity and access controls across cloud environments, engineering systems, CI pipelines, and production infrastructure. Implement least-privilege and just-in-time access models for employees, services, and automated workloads. Cloud and Infrastructure Protection: Secure AWS environments, Kubernetes clusters, containerized applications, serverless workloads, and virtual machines through effective defensive controls and security configurations. Network and Pipeline Security: Strengthen network boundaries, control outbound traffic, secure infrastructure endpoints, and improve CI/CD pipeline security through automated checks and preventive safeguards. Continuous Security Monitoring: Develop continuous vulnerability, access, and attack-surface reviews to replace periodic assessments with ongoing monitoring and actionable security insights. Infrastructure as Code Security: Establish reusable security patterns and automated controls within infrastructure-as-code workflows, ensuring security requirements are consistently applied across environments. Audit and Compliance Support: Improve infrastructure security visibility and automate evidence collection to support internal security reviews and external compliance requirements. Cross-functional Collaboration: Work closely with engineering, business systems, go-to-market, and security teams to translate complex technical findings into clear recommendations and practical improvements. Security Mentorship and Documentation: Produce well-documented security findings, architecture reviews, and technical proposals that enable teams to take action independently. Mentor colleagues and promote a culture of secure engineering practices.

Requirements:

At least 5 years of professional experience in security engineering, cloud infrastructure, or site reliability engineering (SRE), including a minimum of 2 years securing AWS environments at organizational scale. At least 1 year of hands-on experience developing AI agents for real engineering workflows, including building agent skills and tools and maintaining their execution environments, configurations, permissions, integrations, evaluations, and cost controls. Strong understanding of AI agent security risks, including prompt injection, excessive tool permissions, unaudited actions, the confused deputy problem, and the lethal trifecta. Ability to validate agent-generated outputs against evidence and determine when human review is necessary. Deep expertise in AWS Identity and Access Management (IAM), including IAM Identity Center or equivalent SSO solutions, Service Control Policies (SCPs), permission boundaries, resource and key policies, and cross-account trust relationships. Ability to validate IAM policies and access configurations through policy simulation and evidence-based testing rather than assumptions. Production-level experience securing Kubernetes environments, particularly Amazon EKS or similar platforms, including RBAC, workload identity, network policies, admission controls, and container runtime hardening. Strong knowledge of AWS networking and security architecture, including VPC design, endpoints and endpoint policies, network and DNS firewalls, egress controls, and Web Application Firewalls (WAF). Proficiency with infrastructure-as-code tools such as Terraform, including reusable module development, multi-environment deployments, and security-focused plan reviews. Experience with cloud-native application protection platforms (CNAPP), Security Information and Event Management (SIEM) systems, and runtime security tools. Familiarity with AWS security and monitoring services, including CloudTrail, GuardDuty, and IAM Access Analyzer. Demonstrated experience investigating cloud and infrastructure security events by correlating audit logs, Kubernetes activity, identity events, and network telemetry to establish incident timelines, impact, and root causes. Proven ability to conduct architecture reviews, write technical design proposals, and guide engineering teams toward secure solutions through collaboration and constructive feedback. Strong programming and automation skills in at least one of the following languages: Python, Go, or TypeScript. Excellent written and verbal communication skills, with the ability to explain technical risks and security recommendations to both technical and non-technical stakeholders. Comfortable working in asynchronous environments, producing clear, evidence-based documentation, findings, and design recommendations that other teams can implement independently. Strong analytical thinking, problem-solving abilities, attention to detail, and a proactive approach to identifying and addressing security risks. Ability to work independently while collaborating effectively with multidisciplinary engineering and security teams.

Desirable Qualifications:

Experience applying AI agents to Security Operations Center (SOC) activities or incident response workflows. Familiarity with sandboxed execution environments and technologies such as gVisor, Firecracker, or Kata Containers. Previous offensive security or red-team experience involving cloud infrastructure and Kubernetes environments. Knowledge of policy-as-code frameworks and policy engines such as Open Policy Agent (OPA) and Rego. Experience supporting security audits, including SOC 2, through automated evidence collection and continuous control monitoring.

Benefits:

Competitive annual salary ranging from $160,000 to $210,000, depending on experience, qualifications, geographic location, and interview performance. Equity compensation opportunities. 401(k) retirement savings plan. Comprehensive health insurance, including medical, dental, and vision coverage. Flexible spending accounts and health-related spending options. Life insurance and disability coverage. Paid parental leave. Flexible paid time off (PTO). Enhanced employee assistance program. Employee wellness stipend. Professional development stipend. Fully remote working arrangement within the United States. Opportunity to work with modern cloud infrastructure, Kubernetes, security automation, and AI-powered engineering tools. Collaborative engineering environment focused on innovation, continuous learning, and security excellence. Opportunity to influence infrastructure security strategy and build scalable security solutions with measurable organizational impact.

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

 Why Apply Through Jobgether? 

 

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

 

 

#LI-CL1