Security & Infrastructure Engineer - Compliance & AI Governance

Nexxa.AI; San Francisco (CA); On-site; USD 180,000 - 260,000; Full time

Job summary

Nexxa.ai in San Francisco is seeking a security and compliance leader to own certification programs (SOC 2 Type 2, ISO 27001) and the security infrastructure across cloud platforms. You will partner with engineering, product, and operations to build automated controls and audit readiness.

Youll triage findings, drive remediation, and serve as interface to auditors and customers, ensuring scalable governance as the company grows.

Qualifications

• Professional experience in security engineering, infrastructure/platform engineering, or a closely related technical role.
• Deep hands-on experience with security fundamentals, networking, and Linux systems.
• Cloud infrastructure experience with IAM, networking, and compute in AWS or GCP.
• Strong scripting/automation skills and ability to write runbooks and audit responses.
• CS/CE degree or equivalent hands-on experience.

Responsibilities

• Own SOC 2 Type 2 and ISO 27001 certification programs, including evidence collection and audit readiness.
• Triage security findings across cloud posture, code scanning, dependencies, and secrets; drive remediation.
• Remediate findings in infrastructure as code, IAM policy, and pipeline configuration.
• Administer identity and access across cloud and SaaS with least-privilege controls.
• Support IT operations and interface with external auditors and customers on security requirements.
• Build automated controls into infrastructure and strengthen CI/CD and software supply chain security.
• Document runbooks, control narratives, and postmortems to scale governance.

Skills

Security engineering

Infra/Platform engineering

Cloud (AWS/GCP)

Python/Bash/Go

Audits & compliance

Policy & IAM

Education

CS/CE degree

Tools

Pulumi

Terraform

IAM tooling

CI/CD tooling

Job description

Nexxa.ai in San Francisco is seeking a security and compliance leader to own certification programs (SOC 2 Type 2, ISO 27001) and the security infrastructure across cloud platforms. You will partner with engineering, product, and operations to build automated controls and audit readiness.

Youll triage findings, drive remediation, and serve as interface to auditors and customers, ensuring scalable governance as the company grows.