Infrastructure Security Engineer (Senior/Principal)

Cybersecurity Jobs; United States; Remote; USD 170,000 - 325,000; Full time

Job summary

Positron AI seeks a Senior or Principal Infrastructure Security Engineer to secure and manage the move from on-prem systems to a secure hybrid-cloud on GCP. You will own identity and access controls, secure developer infrastructure, secrets management, and detection/response for critical systems.

You will define the identity platform with Auth0 and RBAC, design PKI lifecycle, and lead on-prem to hybrid-cloud migration with IaC using Terraform and Ansible.

Qualifications

• Must have strong identity and access management experience (SSO, RBAC).
• Hands-on with Kubernetes and cloud IaC tools (Terraform/Ansible).
• Production SIEM deployment and incident response experience.
• Experience with PKI and certificate lifecycle automation.

Responsibilities

• Define, operate and secure identity platforms (Auth0, RBAC) across on-prem and cloud.
• Design and manage PKI, certificate issuance and rotation.
• Lead migration from on-prem to a secure hybrid-cloud (GCP) with segmented networks.
• Build and maintain developer tooling and secrets management securely.
• Deploy and operate a SIEM covering critical infrastructure and incidents.
• Lead IR processes from detection through remediation and post-incident review.

Skills

IAM

Kubernetes

Terraform

Ansible

SIEM

Incident response

Tools

Auth0

Okta

Job description

Positron AI is seeking a Senior or Principal Infrastructure Security Engineer to secure and manage the transition from on-prem systems to a hybrid-cloud environment on GCP. This role focuses on identity and access controls, secure developer infrastructure, secrets and artifact protection, and detection and response capabilities for critical systems.

Identity Platform and Access Control

• Define, implement, and operate the identity platform, including Auth0 and role-based access control (RBAC) across internal systems and cloud environments.
• Establish least-privilege access policies and lifecycle processes for users, service accounts, and machine identities.

PKI and Certificate Lifecycle

• Design and manage public key infrastructure (PKI), including certificate issuance, rotation, and revocation.

Hybrid-Cloud Migration and Secure Infrastructure

• Lead the migration of on-prem workloads to a secure hybrid-cloud environment on GCP.
• Design and enforce network segmentation between on-prem, cloud, and critical infrastructure environments.
• Build and maintain cloud infrastructure for developers using infrastructure as code with Terraform and Ansible.

Developer Tooling, Artifacts, and Secrets Management

• Deploy and maintain artifact storage and other core developer tooling with security built in from the start.
• Own secrets management across environments, ensuring credentials and keys are stored, accessed, and rotated safely.

Detection, SIEM, and Incident Response

• Select, deploy, and operate a SIEM solution covering critical infrastructure.
• Build and lead incident response processes, covering detection and triage through remediation and post-incident review.

Required Qualifications

• Expertise in identity and access management, including SSO, RBAC, and identity platforms such as Auth0, Okta, or similar.
• Experience with Kubernetes, including managed or proprietary Kubernetes distributions.
• Hands‑on experience building and managing infrastructure as code with Terraform and Ansible.
• Production experience with GCP, or with Azure or AWS, with willingness to work in GCP.
• Proven experience deploying, tuning, and operating a SIEM solution.
• Experience with PKI, including certificate management and lifecycle automation.
• Demonstrated incident response experience, including leading investigations and remediation.
• Experience deploying and maintaining artifact storage and secrets management systems.
• Understanding of network segmentation and secure network design across on‑prem and cloud environments.

Technologies

Auth0, RBAC, PKI, GCP, Terraform, Ansible, Kubernetes, SIEM, Okta

Benefits

• Fully company‑paid medical, dental, and vision insurance for you and your dependents.
• Company‑paid life and disability coverage, with voluntary options to add more.
• Supplemental hospital, critical illness, and accident coverage available.
• Unlimited paid time off, encouraged for time to unplug and recharge.
• 13 paid company holidays.
• Remote‑first culture with a company‑provided computer and home office setup.
• Competitive salary and equity.
• 401(k) with company matching, eligible from day one.

Preferred Qualifications

• Broader security engineering experience beyond infrastructure, including application or product security.
• Experience designing security architecture for organizations moving from on‑prem to hybrid cloud.
• Familiarity with endpoint detection and response (EDR) tooling and deployment.

What Success Looks Like

• Within the first three to six months, define and stand up the identity foundation with Auth0 and RBAC in place across key systems.
• Enable developers to provision cloud infrastructure through infrastructure as code, while driving on‑prem to hybrid‑cloud migration on a secure, segmented foundation.
• Deploy a SIEM solution for monitoring critical infrastructure to improve visibility and support detection and response workflows.

Visa Support

• Open to candidates currently authorized to work in the U.S.
• No new visa sponsorship available; H‑1B visa transfers may be facilitated for eligible candidates.

Location: Remote (remote)

Salary: USD 170,000 - 325,000 per yearly