Software Engineer - Infrastructure Security

The Infrastructure Security team provides and supports the primitives that enable engineering to securely build applications and meet compliance obligations, while abstracting away the underlying complexity for the best possible developer experience. The team's work centers on workload identity and authorization: how internal applications authenticate to each other and to the services they depend on, and how that access is granted and enforced. The team is replacing static secrets with short-lived identity credentials, bringing identity-based authentication to the services engineers use every day, and unifying how authorization is managed across the company. It is a platform engineering team with a security mission.

Responsibilities

Build workload identity infrastructure, making short-lived identity credentials a default part of every application's runtime environment in partnership with application platform owners; Bring identity-based authentication to internal services by supporting identity certificates, making them the golden path for newly onboarding applications, and driving migration of existing ones; Eliminate static secrets by replacing static passwords and service tokens with short-lived identity credentials and building identity-authenticated egress proxies and API abstractions that inject and automatically rotate managed secrets; Unify authorization by building a single interface and framework through which authorization policies are centrally managed and enforced

Requirements

5+ years of experience in software engineering, with a focus on security-related platform, infrastructure, or distributed systems; Strong working knowledge of secrets management, fine-grained authorization, and workload identity systems; Familiarity with the Kubernetes ecosystem and authentication/authorization technologies such as JWTs, X.509 certificates, PKI, cert-manager, SPIFFE/SPIRE, and OPA; Experience building and operating production infrastructure that other teams depend on, with attention to availability and failure modes; Proven ability to drive cross-team adoption of platform capabilities or lead large-scale migrations; A platform builder who loves building infrastructure other engineers rely on and sweats the developer experience details; Fluent in service-to-service auth, knowing authentication and authorization deeply, including JWTs, X.509 certificates, and when to reach for each; A systems thinker who reasons about bootstrapping, circular dependencies, availability, and failure modes; A pragmatic migrator who can drive adoption across many teams and retire the legacy path; A strong partner to engineering who builds trust and makes security frictionless; Excited about AI and automation to scale platform work and reduce toil; Curious and humble, asks basic questions, enjoys untangling complex systems, and brings others along

Benefits

401k matching; Competitive equity; Healthcare, dental and vision coverage (US only); FSA, ST/LT Disability, Voluntary Life; Carrot fertility benefits; 20 days paid vacation, 10 holidays and unlimited sick leave; 12 weeks fully paid parental leave; Monthly fitness stipend for gyms, yoga classes, race registrations or similar; Monthly wellness stipend for massage, meditation classes, therapy or similar; Commuter benefits for hybrid employees in SF/NYC; Unlimited token usage; Parental leave, paid time off and fully remote working arrangements