Infrastructure Security Engineer (Senior/Principal)

positron.ai; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Remote-first

Company computer

Medical, dental, vision, life, and dis

Disability coverage

401(k) with company match

Unlimited PTO

13 paid holidays

Job summary

positron.ai is seeking a senior security engineer to own identity, infrastructure, and developer security foundations during a migration from on-prem to a hybrid-cloud setup. You will shape authentication, provisioning, segmentation, and threat detection for critical engineering systems.

The role requires hands-on expertise in IAM, RBAC, least-privilege controls, PKI, and IaC with Terraform and Ansible, with migration experience to GCP and a focus on securing developer tooling across teams.

Qualifications

• Senior/principal-level security engineer with hands-on infra security experience.
• Experience with identity management, RBAC, and least-privilege controls.
• Experience migrating on-prem workloads to a GCP-based hybrid-cloud environment.
• Proficient with infrastructure as code using Terraform and Ansible.
• Knowledge of PKI and certificate lifecycle management.

Responsibilities

• Operate the identity platform across internal systems and cloud environments (Auth0).
• Establish least-privilege policies and access lifecycle processes for people, service accounts, and machine identities.
• Manage public key infrastructure including certificate issuance, renewal, and revocation.
• Lead migration of on-prem workloads to a secure hybrid-cloud environment on GCP.
• Build and maintain developer cloud infrastructure using Terraform and Ansible.
• Define network segmentation and secure handling of secrets and artifacts; support threat detection and response for critical systems.

Skills

Identity & access management

RBAC

Least-privilege controls

Hybrid-cloud

Terraform

Ansible

PKI & certificate lifecycle

Threat detection & response

Cloud security

Tools

Auth0

GCP

Terraform

Ansible

Job description

Role overview

Secure the transition from an on-premises engineering environment to a hybrid-cloud setup, owning core identity, infrastructure, and developer security foundations. This hands-on role will shape how people and services authenticate, how systems and resources are provisioned and segmented, and how threats to critical engineering systems are detected and handled.

Responsibilities

• Operate the identity platform, including Auth0 and role-based access controls across internal systems and cloud environments.
• Establish least-privilege policies and access lifecycle processes for people, service accounts, and machine identities.
• Manage public key infrastructure, including certificate issuance, renewal, and revocation.
• Lead migration of on-premises workloads to a secure hybrid-cloud environment on GCP.
• Build and maintain developer cloud infrastructure using Terraform and Ansible.
• Define network segmentation and secure handling of secrets and artifacts; support threat detection and response for critical systems.

Requirements

• Infrastructure security experience suited to a senior or principal-level, hands-on role.
• Practical experience with identity and access management, RBAC, and least-privilege controls.
• Experience building or operating hybrid-cloud infrastructure and migrating on-premises workloads to GCP.
• Familiarity with infrastructure as code, including Terraform and Ansible.
• Knowledge of PKI and certificate lifecycle management.
• Ability to secure developer tooling and engineering infrastructure while working across hardware and software teams.

Benefits and work setup

• Remote-first work with a company-provided computer and home-office setup.
• Company-paid medical, dental, vision, life, and disability coverage; supplemental coverage is available.
• Unlimited paid time off, 13 paid holidays, competitive salary and equity, and a 401(k) with company match.
• Applicants must already be authorized to work in the U.S.; new visa sponsorship is unavailable, though eligible H-1B transfers may be supported.