Remote job
Senior Software Engineer, Proactive Security - Platform
Job details
About this role
Role overview
Build and operate shared security platforms that help engineering teams access infrastructure safely, manage secrets, and authenticate services. The work focuses on making secure practices easy to adopt through self-service tooling and reliable, highly available services used across a large, distributed engineering environment.
Responsibilities
- Design and operate secure workflows for privileged access, identity, and secrets management using access and secret-storage platforms. - Build self-service tools, SDKs, Terraform modules, and integrations for just-in-time access, short-lived credentials, and dynamic secrets. - Operate highly available distributed systems, including their replication, consistency, and consensus mechanisms. - Lead migrations away from long-lived credentials and standing access, measuring progress by the exposure reduced across the platform. - Partner with infrastructure, data, compute, and product engineering teams to integrate secure workflows into Kubernetes, CI/CD, and cloud environments. - Join a follow-the-sun on-call rotation; improve monitoring, runbooks, incident response, and root-cause analysis, including support for controlled AI-agent access.
Requirements
- Six or more years as a software, infrastructure, or security platform engineer in a large-scale internet environment. - Strong production software engineering skills in Go or a comparable language such as Kotlin, Java, or Python. - Experience building or operating access-management, secrets-management, or key-management systems. - Solid understanding of distributed systems, including replication, consistency, and consensus approaches such as Raft or Paxos. - Working knowledge of identity and authentication standards such as OIDC, SAML, mTLS, or workload identity; experience with Kubernetes, infrastructure as code, and AWS or GCP IAM. - Track record of building internal platforms engineers adopt, operating highly available services, and communicating clearly across teams; a relevant degree or equivalent experience is expected.
Nice to have
Experience with Teleport or HashiCorp Vault is a plus. Familiarity with workload identity systems such as SPIFFE or cloud-provider workload identity is relevant.