Senior Security & Infrastructure Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Security & Infrastructure Engineer based in the United States.

As a Senior Security & Infrastructure Engineer, you will own the security, infrastructure, and compliance posture of a cloud environment supporting critical public-sector and regulated-industry applications. You’ll play a central role in advancing a FedRAMP authorization while strengthening production infrastructure, security controls, and operational resilience. The role combines hands-on engineering with compliance leadership, giving you ownership from technical implementation through evidence and authorization. You’ll work closely with engineering and compliance stakeholders to embed security into infrastructure and developer workflows rather than treating it as a final review step. As one of the first dedicated security engineering hires, you’ll have substantial influence over security architecture, automation, and engineering standards. You’ll join a small, interdisciplinary team tackling complex problems with meaningful real-world impact. This is an opportunity to build scalable security foundations for technology used by organizations working to protect communities and critical infrastructure.

Accountabilities:

• Own the security and compliance posture of AWS infrastructure, including the authorization boundary, control implementation, KSI evidence, continuous monitoring, and supporting automation.
• Drive FedRAMP authorization activities in partnership with the compliance lead, including machine-readable evidence management, control implementation, third-party assessment coordination, and preparation for authorization and marketplace listing.
• Harden and modernize production infrastructure through infrastructure-as-code, network segmentation, secrets management, logging, detection, monitoring, and incident response improvements.
• Build security and compliance controls directly into CI/CD pipelines and developer workflows, minimizing manual review requirements and preventing compliance processes from becoming delivery bottlenecks.
• Establish and maintain security guardrails, infrastructure standards, and automated controls that support both developer productivity and regulatory requirements.
• Partner closely with engineering teams to integrate security considerations into architecture, system design, development, and deployment decisions.
• Support continuous monitoring, threat modeling, incident response, and ongoing improvements to the organization’s security posture.
• Translate compliance requirements into practical engineering implementations, ensuring that technical controls and their corresponding documentation remain aligned.
• Collaborate with internal and external compliance, infrastructure, and security partners throughout assessments and authorization activities.
• Identify opportunities to automate repetitive security and compliance processes and improve the reliability, scalability, and efficiency of security operations.

Requirements

• Proven experience completing a FedRAMP authorization, whether through an Agency or JAB pathway, at Moderate level or above, with a strong understanding of the practical challenges involved.
• Deep hands-on experience with AWS and strong infrastructure-as-code expertise, particularly with Terraform or comparable tooling.
• Ability to operate comfortably across both security engineering and compliance, including writing control narratives, developing evidence, and implementing the underlying infrastructure described by those controls.
• Experience with security and compliance frameworks such as SOC 2, StateRAMP, or TX-RAMP.
• Familiarity with continuous monitoring platforms and security observability practices.
• Experience with threat modeling, security architecture, infrastructure hardening, logging, detection, secrets management, network segmentation, and incident response.
• Strong understanding of secure CI/CD practices and the ability to integrate security controls into developer workflows.
• Excellent communication and collaboration skills, with the ability to work directly with engineering and compliance stakeholders and translate regulatory requirements into practical technical solutions.
• Strong ownership mindset and willingness to work hands-on across both strategic initiatives and detailed implementation work.
• Comfortable working in an early-stage, evolving environment where processes and systems are still being established.
• Experience working with Node.js/TypeScript environments, PostGIS, GovTech, or public-sector technology is a plus.

Benefits

• $195,000-$220,000 annual salary, with compensation determined by skills, experience, qualifications, and career level.
• Competitive compensation package.
• Health, vision, and dental coverage.
• 401(k) plan.
• Quarterly wellness reimbursement.
• One expensed lunch per week.
• Flexible work arrangements, with roles available as hybrid or fully remote depending on the work.
• Access to offices in New York City, San Francisco, and Portland, Maine.
• Learning and development opportunities supported through feedback, collaboration, and professional growth.
• Opportunity to join a small, interdisciplinary team where individual contributions have significant influence on technical and business direction.
• Mission-driven environment focused on solving complex problems with meaningful impact on communities and critical infrastructure.
• Inclusive workplace that values diverse perspectives, backgrounds, and experiences.