Staff Platform Security Engineer (Security)

Accountabilities:

• Own and continuously improve security across a multi-account AWS environment, including IAM, Identity Center, networking, compute, storage, secrets, logging, and organization-level guardrails.
• Secure production Kubernetes environments running on Amazon EKS, covering cluster configuration, workload identity, RBAC, admission controls, network boundaries, secrets, container security, and tenant isolation.
• Design and implement least-privilege access models for engineers, services, and automation, including scoped, auditable, and time-bound access to sensitive production systems.
• Protect mission-critical infrastructure supporting systems that process sensitive information and high-value operations.
• Lead security architecture and design for new infrastructure, platform services, and major architectural changes.
• Build reusable infrastructure and policy-as-code controls using technologies such as Pulumi, Terraform, Kubernetes policy engines, and automated configuration validation.
• Harden CI/CD and software supply chains, including GitHub Actions, workload federation, build runners, dependencies, artifacts, signing, provenance, and production access.
• Develop security automation that identifies and remediates cloud and Kubernetes risks at scale, using AI-assisted workflows where they can materially improve analysis, coverage, or response speed.
• Partner closely with Infrastructure, SRE, Developer Experience, and product engineering teams to establish practical platform security standards and drive adoption.
• Take ownership of security issues from initial investigation through implementation, remediation, and production verification.
• Contribute directly to incident response and security improvements while maintaining a balance between strong controls and engineering velocity.

Requirements:

• 7+ years of experience in platform security, cloud security, infrastructure security, security engineering, or a closely related engineering discipline.
• Deep hands-on experience securing production AWS environments, including IAM and resource policies, workload identity, network security, secrets management, logging, organization-level controls, and common cloud security failure modes.
• Strong production Kubernetes security experience, preferably with Amazon EKS, including RBAC, workload identity, admission policies, network policies, pod security, secrets, and cluster hardening.
• Experience securing mission-critical systems where compromise, excessive privilege, or loss of availability could have significant customer or business consequences.
• Strong understanding of identity, authorization, least privilege, isolation, and blast-radius reduction across both human and machine access.
• Experience securing CI/CD pipelines and software supply chains, including GitHub Actions or comparable systems, build runners, workload federation, artifacts, and production deployment paths.
• Experience writing and reviewing infrastructure as code using Pulumi, Terraform, CloudFormation, or similar technologies.
• Ability to write production-quality code and automation using a language such as TypeScript, Python, Go, or Rust.
• High degree of ownership and agency, with the ability to take ambiguous platform security problems from investigation through implementation and verified remediation.
• Strong communication skills and a proven ability to collaborate effectively with infrastructure and engineering teams while maintaining a high security standard.
• Experience with AWS Nitro Enclaves or other trusted execution environments is an advantage.
• Background securing financial, payments, wallet, custody, or other high-value transaction systems is a plus.
• Familiarity with AWS KMS, CloudHSM, cryptographic signing systems, key-management infrastructure, or secrets-management platforms is beneficial.
• Experience operating or securing multi-region AWS and Kubernetes environments at significant scale is a plus.
• Familiarity with Istio, PrivateLink, Transit Gateway, eBPF-based controls, or other cloud-native networking technologies is advantageous.
• Experience with GitHub OIDC, Argo CD, Helm, Crossplane, or Kubernetes-based infrastructure delivery is beneficial.
• Familiarity with security and observability platforms such as Wiz, Datadog, GuardDuty, Security Hub, or CloudTrail is a plus.
• Experience building policy-as-code, automated remediation, or security tooling used across large engineering organizations is valuable.
• Familiarity with blockchain infrastructure or self-custodial wallet architecture is an advantage.

Benefits:

• $200,000–$250,000 USD target base salary, with final compensation influenced by skills, relevant experience, interview performance, and market factors such as location.
• Equity participation.
• Eligibility for a performance bonus program.
• Comprehensive medical, dental, and vision insurance with 100% coverage.
• Stipend for an ideal remote-work setup.
• Flexible working hours.
• Fully remote and supportive work environment.
• Unlimited vacation.
• 401(k) retirement plan.
• Monthly wellness benefit.
• Weekly meal benefit.
• Global company off-sites.
• Opportunity to secure AWS and Kubernetes infrastructure supporting products used by millions of people.
• High-impact work spanning cloud identity, production access, workload isolation, software supply chains, and mission-critical infrastructure.
• Opportunity to build security controls directly into the platform rather than operating solely in an advisory or review capacity.
• Ability to influence architecture early and own security improvements through implementation and production verification.
• Opportunity to contribute to an AI-native security team focused on engineering, automation, and scalable security operations.