Infrastructure Security Engineer (Senior/Principal)

Role Overview

As Positron scales, our engineering environment is evolving from a primarily on-prem footprint to a hybrid-cloud model. We are looking for a Senior or Principal Infrastructure Security Engineer to secure and manage that transition. You will own identity and access management, cloud infrastructure for our developers, infrastructure as code, and the core developer tooling our hardware and software teams depend on every day. This is a hands-on, high-ownership role where you will define the foundations: how engineers authenticate, how infrastructure is provisioned and segmented, how secrets and artifacts are stored, and how we detect and respond to threats against our most critical systems.

Key Responsibilities

Identity and Access Management

• Define, implement, and operate our identity platform, including Auth0 and role-based access control (RBAC) across internal systems and cloud environments.
• Establish least-privilege access policies and lifecycle processes for users, service accounts, and machine identities.
• Design and manage public key infrastructure (PKI), including certificate issuance, rotation, and revocation.

Hybrid Cloud Infrastructure

• Lead the migration of on-prem workloads to a secure hybrid-cloud environment on GCP.
• Build and maintain cloud infrastructure for developers using infrastructure as code with Terraform and Ansible.
• Design and enforce network segmentation between on-prem, cloud, and critical infrastructure environments.

Developer Tooling and Platform Security

• Deploy and maintain artifact storage and other core developer tooling with security built in from the start.
• Own secrets management across environments, ensuring credentials and keys are stored, accessed, and rotated safely.

Detection and Response

• Select, deploy, and operate a SIEM solution covering our critical infrastructure.
• Build and lead incident response processes, from detection and triage through remediation and post-incident review.

Required Qualifications

• Expertise in identity and access management, including SSO, RBAC, and identity platforms such as Auth0, Okta, or similar.
• Experience with Kubernetes, including managed or proprietary Kubernetes distributions.
• Hands-on experience building and managing infrastructure as code with Terraform and Ansible.
• Production experience with GCP, or with Azure or AWS and a willingness to work in GCP.
• Proven experience deploying, tuning, and operating a SIEM solution.
• Experience with PKI, including certificate management and lifecycle automation.
• Demonstrated incident response experience, including leading investigations and remediation.