Principal Infrastructure Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and implement a risk-based DevSecOps strategy.

• Define ownership, establish metrics, create escalation paths, and devise a growth plan for the team.

• Apply preventive AWS controls for identity management, networking, encryption, secrets/key management, and cloud configuration.

• Ensure that security-related activities are logged for the purposes of monitoring, investigation, and auditing.

• Integrate security into Infrastructure as Code (IaC), Continuous Integration/Continuous Deployment (CI/CD), container orchestration, and software supply chains.

• Establish automated pipeline controls, including Static Application Security Testing (SAST), IaC/container scanning, and policy-as-code.

• Collaborate with Application Security (AppSec) and Information Security (InfoSec) teams on security testing, policy creation, risk management, audit evidence, and incident response.

• Assess and prioritize vulnerabilities based on their exposure, exploitability, and potential business impact.

• Oversee remediation efforts and monitor exceptions.

• Assist in investigation, containment, recovery, and enhancement following incidents.

⛳️ Requirements

• Over 10 years of combined experience in software, platform/DevOps, and security engineering, with at least 3 years in a technical leadership role.

• Proven experience in leading cross-functional security or infrastructure projects and influencing teams in engineering, DevOps/platform, AppSec, and InfoSec.

• Practical knowledge of AWS security and Identity and Access Management (IAM), focusing on least privilege, service identities, privileged access, encryption, and networking/security boundaries.

• Demonstrated experience in automating controls through scripting, IaC, CI/CD, and policy-as-code.

• Experience securing end-to-end delivery pipelines, including IaC, CI/CD, containers, dependencies/artifacts, and secrets management.

• Proficiency in prioritizing vulnerabilities based on risk and establishing workflows for ownership, escalation, exceptions, and remediation.

• Background in security incident investigation, containment, recovery, and post-incident analysis and improvement.

• Strong ability to articulate risk and trade-offs to leadership.

• Preferred: Experience in building a security/DevSecOps practice and overseeing the hiring, development, or management of engineers.

• Preferred: Knowledge of Kubernetes/container security, software supply chain security, secure Software Development Life Cycle (SDLC) practices, and collaboration with InfoSec/SOC for security observability/detection.

• Preferred: Experience in selecting security tools, managing vendors and budgets, and assessing control coverage, risk reduction, and remediation progress.

• Preferred: Familiarity with compliance standards such as SOX, SOC 2, or ISO 27001.

🏝️ Benefits

• Unlimited Paid Time Off (PTO).

• Comprehensive medical, dental, and vision insurance.

• Employee equity options.

• Discounts for employees.

• Access to virtual wellness classes.

• Pet insurance coverage.