Infrastructure Security Engineer

Responsibilities

• Design and ship Kubernetes security controls covering admission policy, RBAC, workload identity, network policy, and runtime hardening.
• Harden the software supply chain through package firewalling, artifact signing and provenance, and admission enforcement.
• Own cloud IAM and identity architecture, including least-privilege roles, short-lived credentials, and workload federation.
• Secure research infrastructure, training pipelines, model weights, and datasets.
• Threat model platform components and convert findings into actionable requirements.
• Build guardrails for AI agents and developer tooling operating inside the infrastructure.
• Write infrastructure as code and policy as code and ship security changes through standard review and rollout processes.
• Support incident response with infrastructure analysis and containment guidance.

Requirements

• Hands-on production experience securing Kubernetes, including admission policies, RBAC, workload identity, and cluster compromise scenarios.
• Working knowledge of cloud IAM and networking, including identity federation and short-lived credentials, on at least one major cloud platform.
• Experience with infrastructure as code and GitOps-style deployment.
• Ability to write Python, TypeScript, Rust, or another programming language for engineering tooling.
• Understanding of software supply-chain attacks and controls including signing, provenance, SBOMs, and admission enforcement.
• Strong technical writing skills for design documents, threat models, and engineering explanations.
• Sound judgment in selecting, enforcing, and safely rolling out security controls.
• Preferred experience securing GPU or HPC-style compute, training pipelines, or research environments.
• Preferred experience with policy engines and admission controllers such as Kyverno, OPA Gatekeeper, or Falco.
• Preferred experience with multi-tenant cloud isolation, ABAC, scoped credentials, and per-tenant boundaries.
• Preferred experience producing security architecture evidence for SOC 2, ISO 27001, or other audits and customer assessments.
• Open-source contributions or published work in cloud or Kubernetes security are a plus.

Benefits

• Remote hiring is available, with offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv.
• The company emphasizes pay equity, diversity, equal opportunity, and an inclusive workplace.