Principal Infrastructure Security Engineer

Description

The company is hiring a principal to set the direction for cloud and infrastructure security across all product lines, AWS accounts and environments. You will shape the architecture vision and the security invariants that steer engineering choices, and you will own the company's overall cloud security posture.

You will work with Engineering, Product Management and technology leaders on cloud security trade-offs that affect business, regulatory or reputational outcomes. You will also grow the team's technical culture and develop Staff-level engineers so that its standards, detection frameworks and architectural judgment outlast any one project. The company treats security as a shared responsibility built into its engineering approach.

Responsibilities

• Define the multi-year cloud security architecture vision and the invariants that govern engineering decisions across every product line, AWS account and infrastructure component.
• Set the strategy for cloud security tooling and automation, including how AI changes security operations, and make build-versus-buy calls that shape what the team can deliver for years.
• Design and enforce company-wide guardrails in AWS, such as SCPs, IAM boundaries, AWS managed security services, custom solutions and policy-as-code, and put in place the standards and processes that keep them in force.
• Build threat models and security approaches, and spot emerging threats to identity, data, AI workloads and infrastructure before they turn into incidents.
• Create frameworks and methods for integrating third-party cloud services and internal platforms securely, and drive their adoption across the company.
• Predict broad shifts in cloud and infrastructure security, find where the current approach will stop scaling, and propose fixes ahead of that point.
• Build AI and automation frameworks and work with other functions to launch reusable agents that several teams can use.
• Lead large cross-team programs to schedule and quality, splitting complex work into pieces that contributing teams can carry out.
• Grow the cloud security team's long-term technical culture, develop Staff-level cloud security engineers and sponsor future leaders in the company.
• Advise C-suite and board members on cloud security investment, cloud adoption strategy and organizational risk acceptance.

Requirements

• 10+ years in cloud security or platform engineering, including leading large cross-team initiatives with company-wide impact and delivering them on time.
• Advanced skill in at least one high-level language. Python is strongly preferred, and Kotlin or TypeScript is a plus.
• Expert-level AWS experience across identity and access management (IAM, Orgs and SCPs, Identity Center), networking (VPC, Security Groups, Transit Gateway, Load Balancers, Network Firewall), compute (EKS, ECS, Lambda), data persistence (S3, Aurora, DynamoDB) and logging and monitoring (GuardDuty, CloudTrail, CloudWatch).
• Proven record of setting enterprise-wide access management strategy and IAM/SCP policy frameworks, and of designing cloud security architecture that engineering teams adopted.
• Deep knowledge of cloud workload protection, infrastructure monitoring and threat detection in AWS-native environments.
• Expert-level experience securing Kubernetes and Amazon EKS, including EKS Auto Mode, covering cluster access control, network policy, Istio service mesh, Kyverno admission policy and image signing with cosign.
• Fluency with infrastructure-as-code such as OpenTofu or Terraform, GitOps delivery such as ArgoCD, and CI/CD practices, plus experience setting tooling and automation strategy and making build-versus-buy decisions.
• Ability to present cloud security risk and trade-offs to executives and to influence investment, cloud adoption and risk acceptance decisions.
• History of spotting broad change in cloud security and acting on it before it became urgent.
• Experience building AI or automation frameworks and reusable agents that change how cross-functional teams work.
• Experience developing senior engineers, sponsoring emerging leaders, and building team standards, detection frameworks and architectural judgment that last beyond individual projects.

Conditions

You must be permitted to work in Ireland, including under EU work authorization, without the need for employer sponsorship.

The company is headquartered in Lake Tahoe, with offices in New York, Reno, the Bay Area and Dublin, Ireland.

The company is an equal opportunity employer that does not discriminate.