Principal Security Engineer

Code Red Partners; San Francisco (CA); On-site; USD 210,000 - 290,000; Full time

Job summary

Code Red Partners in San Francisco is seeking a hands-on cloud security/infra engineer to design and build a production-ready AWS environment, IAM, network architecture, and guardrails for agentic development.

Reporting to the Head of Security, you will own Terraform pipelines, policy as code (OPA), CI/CD gates, and secure software supply chain, with a budget and no large team.

Qualifications

• Hands-on AWS experience at scale.
• AWS security focused infrastructure design experience.
• Familiarity with IAM, network architecture and guardrails for AI/development environments.
• Terraform, CI/CD pipelines and policy-as-code tooling.

Responsibilities

• Hardened multi-account AWS environment with SCPs and secure networking.
• IAM at scale with least privilege and short-lived roles.
• Guardrails for agentic development including sandboxing and restricted egress.
• Terraform and policy-as-code (OPA), CI/CD with production gate.
• Software supply chain integrity and tamper-resistant logging.
• CSPM selection and secure data ingress for development mirrors production.
• Hands-on AWS experience and budget ownership in a small team.

Job description

San Francisco, CA · On site, 5 days a week

Code Red Partners is exclusively partnering with a San Francisco investment firm on a foundational cloud security hire, reporting directly to their Head of Security. The team is small and exceptionally technical, working from an explicit thesis on where AI is heading. Development runs heavily through AI agents that write code and provision infrastructure, which makes the environment fast to work in and permissive by default.

This is a builder's role. You'll design and implement that environment yourself, from IAM to network architecture to the guardrails around agentic development. Hands on seat, real budget behind it.

• Hardened multi account AWS environment: SCPs, network layout, private connectivity
• IAM at real scale: least privilege, short lived roles, per workload identities
• Guardrails for agentic development: sandboxed execution, restricted egress, anomaly detection that traces an AI action back to its instruction
• Terraform and policy as code (OPA), CI/CD with a real review gate into production
• Software supply chain and tamper resistant logging across control and data plane
• CSPM selection, secure external data ingress, and a dev environment that mirrors production
• Deep hands on AWS: IAM at scale, network design, Terraform others build on, CI/CD you ran, policy as code
• Built something significant with little support, ideally as the only security or infra person somewhere, with budget and no team
• A real point of view on containing agent generated code: prompt injection, sandboxing (containers, gVisor, Firecracker); production experience is a plus but not required
• Learns fast, comfortable with a broad remit, works well with researchers and scientists

Equal Opportunity Statement

At Code Red Partners, we're deeply committed to working with equal-opportunity employers and helping to build a diverse and inclusive workforce. People are at the heart of everything we do, and we are proud to support teams shaping the future of cybersecurity through innovation, empathy, and technical excellence.