Senior Infrastructure Security Software Engineer (Remote)

This role will be supporting both our Quora and Poe products. You will be a key member of the newly created Security Engineering Team, with a mission to keep Quora safe from security problems by building robust protections around our products, infrastructure and people.

Responsibilities

Partner with engineering teams to review cloud and compute architecture design changes; Establish threat models for cloud and compute paved roads to identify security risks; Develop or adopt open-source tools to monitor and harden cloud infrastructure, harden OS, develop security logging pipelines, and detect intrusions; Apply expert knowledge of security best practices for AWS and Kubernetes to inform remediations and the team's control roadmap; Drive the definition and implementation of security policies and monitor conformance to the policies; Write code for automations that support security requirements like threat detection, incident containment, and network access management; Conduct initial incident triage; determine scope, urgency, and potential impact of security incidents; participate in the incident response process.

Requirements

Sweat the right details: thrive in understanding details but ruthlessly prioritize critical issues; Right-size the solution: recognize guidelines and frameworks do not always fit the problem and adjust the solution for scalability; Ownership: outcome focused, navigate obstacles, decompose complexities, manage time, communicate vision to peers and management; Capable software engineer with domain expertise in at least one of: Cloud Infrastructure Security, Automation and Secure Development Practices, Linux/System Security; Hands-on experience securing large-scale cloud environments, particularly AWS; Build secure infrastructure-as-code (IaC) pipelines using Terraform or CloudFormation; Understand IAM policies, network segmentation, VPC design; Thorough grasp of monitoring and logging in cloud-native environments; Skilled in identifying misconfigurations, mitigating risks, driving remediation processes; Skilled at automating security processes and integrating security tools into CI/CD pipelines; Experience with SAST, DAST, and dependency scanning; Advocate for secure coding practices and mentor teams; Well versed in AWS infrastructure security; Knowledge of container security, POSIX Capabilities, SECCOMP, LSM, OSQuery, eBPF; Availability for meetings and impromptu communication during Quora coordination hours (Mon-Fri: 9am-3pm Pacific Time).

Nice to have

Product Security: experience building secure web applications and APIs with working grasp of OWASP Top 10 and common vulnerabilities such as XSS, CSRF, and SQL injection; Bonus points if implemented security in Kubernetes clusters or serverless architectures.

Benefits

Medical/dental/vision coverage; Equity refreshers; Remote work reimbursement; Paid time off; Employee assistance programs; More benefits (country-specific and may vary).