Security Engineer, Platform US - Remote · September 1, 2026

INFRO; Northern (KY); Hybrid; USD 110,000 - 170,000; Full time

Job summary

INFRO is seeking a security-focused engineer to own credential storage, including key rotation and the key-encryption-key lifecycle. You will strengthen authentication and authorization for customers and staff with MFA, sessions, and RBAC, and run threat modelling for new features.

You will build detection for leaked keys, write runbooks, and prepare the platform for audits and security questionnaires. You will also contribute to documentation and ensure secure software practices across a

Qualifications

• 4+ years in application or product security with hands-on engineering in production code.
• Practical cryptography knowledge: authenticated encryption, key management.
• Experience with web authentication and secure API design.
• Ability to write and review TypeScript.

Responsibilities

• Own credential storage, key rotation and the key-encryption-key lifecycle.
• Harden authentication and authorization for customers and staff, including MFA, session handling and role-based access.
• Run threat modelling and security review for new features, and fix what you find.
• Build detection for leaked keys and abusive traffic, and write the runbooks for responding to them.
• Prepare the platform and its documentation for independent audits and customer security questionnaires.

Skills

Security engineering

Cryptography

Web authentication

TypeScript

Tools

OAuth

CSRF

CORS

AES-256-GCM

Job description

Customers connect their own AI provider accounts to INFRO, which means we hold their credentials. They are sealed with AES-256-GCM, bound to the tenant and connection they belong to, and never shown back. Applications use scoped INFRO gateway keys instead.

You will own the security of that vault and of everything around it: sign-in, sessions, staff access, audit logging and the controls an enterprise security review will ask about.

What you will do

• Own credential storage, key rotation and the key-encryption-key lifecycle.
• Harden authentication and authorization for customers and staff, including MFA, session handling and role-based access.
• Run threat modelling and security review for new features, and fix what you find.
• Build detection for leaked keys and abusive traffic, and write the runbooks for responding to them.
• Prepare the platform and its documentation for independent audits and customer security questionnaires.

What you will bring

• 4+ years in application or product security, with hands-on engineering in a production codebase.
• Practical cryptography knowledge: authenticated encryption, key management and what not to build yourself.
• Experience with web authentication (OAuth, sessions, cookies, CSRF, CORS) and secure API design.
• Ability to write and review TypeScript.

Nice to have

• Experience preparing for SOC 2 or ISO 27001 audits.
• Cloud security on Cloudflare, AWS or GCP.
• Background in multi-tenant SaaS isolation.