Senior Security Engineer, Platform

ABOUT THE ROLE

The client is seeking a Senior Security Engineer to join our Platform team in a long-term, embedded contract role. Your mission is to make secure engineering a consistent, practical part of how we build and operate software. You'll help teams translate security expectations into clear standards, reusable controls, and everyday engineering practices that protect our systems and data.

This is a hands-on individual contributor role with no people-management responsibility. You'll write code, improve infrastructure and delivery workflows, and work alongside colleagues in cloud engineering, DevOps, data engineering, and Engineering Operations. You'll contribute to broader Platform goals while keeping security implementation and cross-team adoption as your primary focus.

You'll recommend technical security standards for engineering leadership's approval, then help teams implement and sustain them. You'll partner with Legal & Compliance to translate policy expectations into technical controls; leadership retains policy approval and risk-acceptance authority. We're looking for a broad security generalist who builds solutions and develops others' capabilities, not an auditor or an approval gate for every release.

RESPONSIBILITIES

• Assess risks across cloud infrastructure, identity, applications and APIs, software delivery, and data protection; maintain a prioritized improvement backlog based on exposure and business impact. Track standards adoption, exceptions, and unresolved risks, communicate tradeoffs to engineering leadership, and partner with Engineering Operations on rollout and follow-through.
• Partner with Legal & Compliance to inform security policies, translate requirements into practical engineering controls, and validate that those controls are effective.
• Develop practical technical security standards with engineers and Tech Leads, including implementation examples, verification methods, and an exception process for leadership approval.
• Build and maintain reusable infrastructure and security controls as version-controlled code, with peer review, automated testing, and CI/CD delivery. Reduce manual configuration and drift, and provide secure, self-service patterns for teams.
• Pair with teams to improve access controls, authentication and authorization, secrets management, infrastructure configuration, and sensitive-data handling in real systems. Use lightweight threat modeling, targeted design reviews, and coaching to help teams identify risks early and make sound security decisions independently.
• Implement and improve automated security testing throughout our development and delivery workflows, including SAST/DAST, dependency scanning, secrets detection, and infrastructure-as-code checks. Ensure findings are actionable and security controls support efficient software delivery.
• Establish effective vulnerability management and coordinated disclosure practices, including risk-based prioritization, external researcher engagement, remediation tracking, and verification of fixes.
• Strengthen security logging, detection, and incident readiness through response playbooks and exercises. Work with Platform and application teams on investigation, evidence preservation, containment, and recovery, and turn blameless post-incident reviews into preventive improvements.
• Contribute to Platform reliability, automation, and developer experience; document decisions, share knowledge, and ensure other engineers can maintain the capabilities you build.

REQUIRED EXPERIENCE & QUALIFICATIONS

• 5+ years of professional experience in security engineering, software engineering, cloud engineering, or platform engineering, including meaningful hands-on responsibility for securing production systems.
• Hands-on experience shipping security improvements to production in a security, software, cloud, or platform engineering role, with a track record of turning recommendations into working controls that multiple engineering teams adopted and sustained.
• Broad working knowledge of cloud security, identity and access, application and API security, secure software delivery, and data protection, with deeper implementation experience in one or more of these areas. Strong hands-on experience securing cloud environments, including permissions, networking, secrets, and logging. AWS preferred; strong experience with another cloud is welcome.
• Hands-on experience authoring and maintaining infrastructure as code (e.g., AWS CDK, Terraform, or CloudFormation) and security automation. You can write and review code, use Git-based workflows, test changes, and deploy through CI/CD rather than relying primarily on manual console administration.
• Practical experience integrating automated security checks into engineering workflows, evaluating findings, and working with engineers to remediate vulnerabilities. Familiarity with the strengths and limitations of SAST and DAST approaches.
• Sound risk judgment: you can distinguish material exposure from low-impact findings, explain tradeoffs, and prioritize achievable improvements.
• Ability to investigate ambiguous problems independently, collaborate with system owners, and follow work through implementation and verification.
• Clear written and verbal communication in English, including useful technical documentation and constructive collaboration in a distributed team.

PREFERRED EXPERIENCE

These will set you apart but aren't required to apply.

• Experience with tools in our environment, such as AWS CDK (TypeScript), GitHub Actions, Kubernetes/EKS, and Datadog.
• Experience building security capabilities in a smaller organization or embedding within a Platform or product engineering team.
• Experience translating security and compliance frameworks, such as SOC 2, NIST, or ISO 27001, into practical technical controls and repeatable evidence collection.
• Experience with customer-facing APIs, mobile SDKs, data platforms, or high-volume transaction systems; ad tech or performance marketing familiarity is a plus.
• Experience supporting coordinated vulnerability disclosure, collaborating with external security researchers, or participating in security incident response and exercises.
• Experience evaluating data-exposure and access risks in AI-enabled tools and workflows.

Relevant degrees and certifications are welcome, but not required. We care most about what you've implemented, how you reason about risk, and how you help teams improve.

CULTURE FIT

• Curious and pragmatic: you ask questions, understand context, and improve security without relying on fear, blame, or unnecessary bureaucracy.
• Ownership-minded: you take problems from discovery through implementation, adoption, and follow-up rather than stopping at recommendations.
• Collaborative: you build trust through pairing, teaching, and direct, constructive feedback, and influence teams without relying on formal authority.
• DevOps mindset: you favor small, tested changes, trunk-based development, automation, observability, and shared operational ownership. You treat infrastructure and security configuration as software that teams can review, reproduce, and improve.
• Comfortable partnering with our cross-functional, Mission Aligned Teams across Engineering, Product, and Data while respecting their ownership of their systems.
• AI-forward: you proactively use AI-assisted tools to improve engineering work, validate their output, protect sensitive information, and help teams adopt them responsibly.