Senior Product Security Engineer

Responsibilities

• Threat-model Snyk’s GCP and AWS cloud infrastructure and negotiate required security changes with the platform teams that own the systems.
• Use AI coding agents to draft Terraform, Kubernetes, and pipeline fixes, then raise changes for review and merge by owning teams.
• Scale agent-driven infrastructure fixes across repositories while ensuring changes are scoped and reviewable.
• Write and maintain agent skills, prompts, instruction files, and security baselines.
• Connect AI agents to live cloud, CSPM, and ticketing data through MCP servers, command-line tools, and provider APIs.
• Review AI-generated infrastructure changes for invented resources, unsafe defaults, overly broad IAM permissions, leaked secrets, and unreviewed changes.
• Harden GCP and AWS IAM, including resource hierarchies, roles, conditions, service accounts, workload identity federation, and organization policies.
• Improve GKE, Kubernetes, and container security, including cluster hardening, RBAC, admission control, network policy, and secure image pipelines.
• Add automated security testing and CSPM tooling to CI/CD and GitOps pipelines and help teams remediate findings.
• Benchmark infrastructure against the CIS Google Cloud Foundation Benchmark, ISO 27001, and NIST 800-53 controls.
• Measure the effectiveness of agent-driven remediation and continuously improve the approach.

Requirements

• 5–8 years of experience running or securing cloud infrastructure, ideally including building and operating production platforms on GCP or AWS.
• Deep hands-on GCP knowledge, including GCP security services, plus working knowledge of AWS; equivalent AWS IAM depth is a bonus.
• Strong knowledge of GCP IAM, resource hierarchies, IAM roles and conditions, service accounts, workload identity federation, organization policy constraints, and least-privilege design.
• Practical Kubernetes and container experience, primarily with GKE, including private clusters, Autopilot, RBAC, admission control, workload identity, network policy, and secure container images.
• EKS experience is welcome.
• Experience with infrastructure as code such as Terraform and automated deployment through CI/CD pipelines and GitOps.
• Solid DevSecOps practice, including threat modeling, shift-left testing, continuous monitoring, and converting findings into infrastructure changes.
• Confidence using AI coding agents such as Claude Code and writing guidance and prompts for reliable output at scale.
• Ability to critically assess AI-generated infrastructure changes for invented resources, unsafe defaults, and overly broad IAM permissions.
• Ability to work consultatively and influence teams that own and operate infrastructure.
• Application security knowledge such as code review and OWASP Top 10 experience, or experience with Snyk or similar security testing tools, is preferred.

Benefits

• Flexible working hours, work-from-home allowances, in-office perks, and time off for learning and self-development.
• Generous vacation and wellness time off, country-specific holidays, and 100% paid parental leave for all caregivers.
• Health benefits, employee assistance plans, and an annual wellness allowance.
• Country-specific life insurance, disability benefits, retirement or pension programs, mobile phone allowances, and education allowances.