Cloud Infrastructure Security Engineer

Athyna; Ciudad de México; Hybrid; MXN 1,790,000 - 2,813,000; Full time

Job summary

Athyna is searching for a Cloud Infrastructure Security Engineer for a short-term, fully remote role. The engineer will secure a cloud environment across GCP, Terraform, and Cloudflare, aligning credentials and access controls with best practices.

This contract spans a couple of months, with flexible hours and an emphasis on hands-on implementation. The role involves collaborating with the internal security team to remediate findings, implement SOC scales, and document SOC 2 evidence while

Qualifications

• 5+ years in infrastructure, platform, or security engineering, including 3+ years securing production cloud environments.
• Hands‑on GCP security experience including IAM, org policies, logs, and secrets management.
• Strong Terraform experience with modules, state, drift, and importing resources.

Responsibilities

• Review and remediate GCP IAM findings and policy issues.
• Implement Cloudflare Access and Zero Trust with Terraform and scoped credentials.
• Harden GitHub Enterprise Cloud with branch protection and OIDC deployment credentials.
• Send logs to SIEM and create initial security alerts; triage findings across resources.

Skills

GCP security

Terraform expertise

Cloudflare Zero Trust

Okta integration

GitHub CI/CD security

Secrets rotation

Linux & containers

Kubernetes

Clear written communication

Education

Bachelor's degree in CS or related field

Tools

Terraform

Cloudflare

Okta

GitHub Enterprise Cloud

GCP IAM

Job description

Cloud Infrastructure Security Engineer, are you there?

Hey there! We’re looking for a Cloud Infrastructure Security Engineer for a short-term contract (a couple of months) with an AI startup that builds environments to train and verify AI agents, focused on securing their cloud environment and closing a backlog of security findings. If you are methodical, a clear communicator, and hands-on with Terraform and GCP, keep reading!

100% Remote
Salary in USD
LATAM, Reporting to the United States (PST overlap, flexible hours)
Full Time (Contract, a couple of months)
Advanced English

About our client

You will be working for our client, a venture-backed AI startup that builds reinforcement learning environments for AI post-training, focused on helping teams train and verify reliable AI agents. This is a full-time contract engagement of a couple of months (40 hours per week), working alongside their internal security team.

About Athyna

Athyna is a Global Talent Platform, helping align world‑class talent with the best employment opportunities across the globe.

We believe in the future of work. That’s why we are a 100% globally distributed team across 5 continents. We believe in people, and we value freedom, integrity, quality, and sustainability.

We’re proudly carbon neutral as an organization. We’re very keen on social impact - we truly care about everyone on our team, and we want to make the world a better place for all of us.

In your day-to-day, you will

• Review and remediate GCP IAM findings, including personal account access and overly permissive access, managing IAM and organization policies through Terraform
• Bring in-scope Cloudflare configuration (DNS, WAF, Access, and Zero Trust Gateway) under Terraform, and replace personal API tokens used in automation with appropriately scoped credentials
• Establish a secure deployment path for internal applications using Cloudflare Access and Okta, with route-level authorization and controls that prevent access to application origins bypassing Cloudflare
• Triage exposed or unmanaged secrets, coordinate credential rotation, migrate secrets to GCP Secret Manager, and replace long-lived credentials with short-lived ones where supported
• Harden GitHub Enterprise Cloud, including branch protection, SCIM provisioning, secret scanning, and OIDC‑based deployment credentials
• Send logs from GCP, Cloudflare, GitHub, and Okta to the SIEM and create initial security alerts
• Investigate and drive remediation of Aikido findings across repositories, virtual machines, containers, and cloud infrastructure
• Document completed work, provide a runbook for each deliverable, and produce SOC 2 evidence in Vanta
• Work hands-on against a defined design alongside the internal security team, who keep architecture decisions

Skills you have

• 5+ years in infrastructure, platform, or security engineering, including 3+ years securing production cloud environments
• Hands‑on GCP security experience, including IAM, organization policies, audit logging, workload identity, and secrets management
• Strong Terraform experience, including modules, state management, drift, and importing existing resources
• Hands‑on experience with Cloudflare Access and Zero Trust, with familiarity with DNS, WAF, and API token scoping
• Experience integrating Okta with applications using standards such as SAML, OIDC, and SCIM
• Experience securing GitHub and CI/CD workflows, including repository controls, secret scanning, and short‑lived deployment credentials
• Experience managing secrets and rotating credentials
• Working knowledge of Linux, containers, and Kubernetes
• Ability to read Python or TypeScript, recognize access‑control issues, and work with engineers to explain and address them
• Clear written communication and a commitment to documenting work as part of each deliverable

Skills that will make you stand out

• GCP VPC Service Controls
• AWS experience, particularly with Amazon WorkSpaces
• Experience implementing SOC 2 or ISO 27001 controls
• SIEM and detection engineering experience
• Experience securing LLM‑backed or agentic systems and data pipelines
• Experience working in a small security team or as a solo security practitioner at a startup