Senior Security Platform Engineer

Description

The company is hiring a senior engineer to work across cloud infrastructure, platform engineering and security operations. The role is hybrid. You will be comfortable fixing a Terraform module, tuning a SIEM detection rule and leading an incident response investigation, and you will be a primary technical escalation point for platform reliability and security incidents in all cloud environments.

Success means production infrastructure incidents are resolved quickly, with root causes found and prevention fixes shipped as module or pull request updates. It also means SIEM coverage grows steadily with accurate, low-noise detections, security incidents are triaged and closed with clear communication and written runbooks, and identity and access controls keep getting stronger. Partners in data, application and payments teams should see you as a dependable technical partner.

Responsibilities

• Cloud infrastructure and platform engineering: write and maintain infrastructure as code for cloud providers such as Terraform, including shared modules used by application teams across the organization.
• Handle the lifecycle of IAM users, keys and secrets, covering rotation, storage in Parameter Store or Secrets Manager, and consistency across environments.
• Troubleshoot production networking and infrastructure problems involving load balancer health checks, security groups, WAF rules, CDN and origin access, DNS and container orchestration.
• Manage access on platforms such as AWS, GCP and GitHub, plus internal developer tools.
• Assess and integrate third-party platform and security tools, such as CSPM products and code security scanners.
• Support CI/CD pipelines and fix build and deploy failures.
• SIEM and detection engineering: run the organization's Elastic Security platform from end to end, including cluster upgrades, agent and integration management, and ingestion pipelines for cloud audit logs, identity provider logs, payment and fraud logs and WAF logs.
• Build and tune detection rules and alerting workflows, and route SIEM alerts into team chat channels such as Slack.
• Improve alert quality by fixing log parsing errors, refining index patterns and cutting false positives.
• Keep technical documentation current for the logging architecture and the logic behind detection rules.
• Security operations and incident response: lead and oversee the SOC team day to day, covering prioritization, escalations, investigation quality and mentoring.
• Act as the senior escalation point for the SOC and coach analysts through their investigations.
• Lead investigations into suspicious sign-ins, account compromise and unusual network traffic, and coordinate remediation such as session revocation, credential resets and contacting users.
• Write and maintain incident response runbooks and reference material.
• Build and run WAF-based detection and blocking, such as blocking malicious or fraudulent traffic by device fingerprint or IP address.
• Identity, access and compliance: lead identity governance work, including reconciling managed and unmanaged cloud accounts and auditing licenses and access.
• Design and roll out stronger authentication, including conditional access policies, MFA and authentication strength requirements, and retiring legacy protocols such as legacy SMTP authentication.
• Work with IT and security leadership on identity provider strategy and vendor license decisions.
• Application, AI and code security: take end-to-end security ownership of the core stack, which includes React Native and React Web front ends, Node.js, Spring Boot and Java, and Python with Flask back ends, plus AI and ML systems.
• Review code and architecture for vulnerabilities such as supply chain risk, poor secrets handling, authentication and authorization flaws and insecure API design across mobile, web and service layers.
• Work with application teams to build security into the software development lifecycle, through secure coding standards, pull request review gates and SAST, SCA and secrets scanning in CI/CD.
• Triage and drive fixes for issues found by code scanning and vulnerability management tools such as Wiz and GitHub Advanced Security, across the full stack.
• Track risk in open-source and third-party dependencies from npm, Maven, Gradle and pip, and coordinate patching for critical CVEs.
• Serve as the security contact for teams building on the stack above, keeping security consistent regardless of language or framework.
• Own the security of AI and ML systems and LLM features, including model access controls, governance of training and prompt data, prompt injection and jailbreak risk, and secure use of third-party AI APIs and vendors.
• Assess AI coding assistants and internal AI tools for data exposure, IP leakage and supply chain risk before wider rollout.
• Set security guardrails and review processes for teams building AI features or agents, and monitor for abnormal or abusive usage.
• Payments and fraud security: work with risk and payments teams to investigate and reduce payment fraud, including card-testing and BIN attacks and risk score anomalies in third-party payment platforms.
• Review and recommend changes to fraud rules, allow-lists and risk profiles.
• Track and help prioritize security tickets for payment endpoints.

Requirements

• Required: 5+ years in infrastructure or platform engineering, with hands-on production ownership across multiple cloud accounts.
• Required: Strong Terraform or infrastructure as code experience, including writing and maintaining shared modules.
• Required: Experience running a SIEM, with Elastic Security preferred, covering log ingestion, detection engineering and alerting.
• Required: Solid grasp of networking basics: load balancers, security groups, WAF, DNS and CDN.
• Required: Experience with identity providers such as Entra ID, Azure AD or Okta, and with SSO, SAML, MFA and conditional access.
• Required: Proven experience leading or doing significant work in security incident response.
• Required: Able to act as a hands-on technical escalation point for several teams at once.
• Required: Working knowledge of application security across modern web, mobile and back-end stacks, such as React, React Native, Node.js, Java with Spring Boot and Python with Flask. You can read code, understand architecture and spot security risks without writing production application code every day.
• Preferred: Proven experience with AWS, GCP and Azure.
• Preferred: Familiarity with payments security, such as fraud scoring, PCI-adjacent systems and payment gateway risk tools like Adyen.
• Preferred: Experience with container orchestration such as ECS or similar.
• Preferred: Experience mentoring SOC analysts or junior engineers.
• Preferred: Familiarity with CSPM and vulnerability management tools such as Wiz or CrowdStrike.
• Preferred: Hands-on development or code review in React Native, React Web, Node.js, Spring Boot or Java, or Python with Flask.
• Preferred: Experience with SAST and SCA tools such as GitHub Advanced Security, Snyk or SonarQube, and with adding security scanning to CI/CD.
• Preferred: Familiarity with AI and LLM security, including prompt injection, data leakage and model access control, and with securing AI features or internal AI tools.

Conditions

Hybrid role.

Must have a legal right to work in the United States.

Other duties not listed here may be assigned to keep the department running properly.

We are an equal opportunity employer, and applicant information is handled confidentially under EEO guidelines.

Benefits

• Competitive salary and benefits, plus commission opportunities that the company describes as industry leading for club employees.
• Complimentary club membership.
• Discounts and incentives on products and services, including personal training, Pilates, spa and shop.