{"id":2233754,"url":"https://alion.io/job/one-identity-principal-security-engineer-cloud-and-infrastructure-security","title":"Principal Security Engineer Cloud and Infrastructure Security","company":{"id":9394,"name":"One Identity","domain":"oneidentity.com","url":"https://alion.io/company/one-identity","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["India"],"countries":["IN"],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":26000,"max_usd":63000,"period":"year","method":"role_seniority_country_cell","sample_n":13},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"FedRAMP","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"SOC 2","optional":false},{"name":"Telegram","optional":false}],"status":"live","first_seen_at":"2026-10-10T23:25:25Z","employer_posted_date":"2026-10-10","last_verified_at":"2026-10-14T02:47:34Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"Overview\nPrincipal Security Engineer Cloud and Infrastructure Security\nOne Identity · Information Security, Attack Surface\nPrincipal individual contributor · India · Reports to the Director of Information Security\nWhy this role exists\nThe architecture set in this role decides which certifications One Identity can hold and which markets we can sell into. That is unusual commercial weight for an engineering seat, and it comes with a mandate from leadership to build the program behind it.\nWe sell on-premises and hosted solutions. Some products run as hosted services we operate in Azure and AWS. Others ship as software customers deploy in their own datacenters. Infrastructure security here has two audiences: the environments we run, and the base images, container definitions, and deployment defaults we publish, which become part of every customer's environment. A hardening decision made once is inherited by everyone who deploys it.\nWe're separating from Quest Software and building an independent security function. The team is lean and globally distributed, and this role is its senior technical voice. Scope comes from what you design and automate, and from what engineering chooses to adopt.\nWhat you'll do\nShape the architecture\nOwn security architecture across Azure and AWS: tenant, subscription and account design, network segmentation and traffic control, private connectivity, egress policy, workload isolation. Where a regulated market or a certification constrains a design, you're expected to know before it's committed.\nRun our own products against real security requirements and tell us what you find. IT operates our privileged access controls on One Identity software, so you'll see how our products hold up under production pressure and take that back to the teams building them.\nBring engineering into architectural decisions early. Designs teams help shape are the ones that hold up in production.\nRaise the engineering bar\nTeams already build with infrastructure as code across both clouds. Raise the security ceiling inside that practice: hardened modules, secure-by-default landing zones and account baselines, and patterns teams reach for because they're better.\nExtend policy as code across the pipeline and the platform so teams get a signal at commit time.\nOwn the hardened image pipeline for virtual machines and containers, covering the fleet we run and the images we publish: build, patch cadence, provenance, signing, and the automation that keeps both current.\nSecure the container orchestration layer, including the reference architecture and secure defaults customers inherit when they deploy our products on their own clusters.\nSet the security architecture for AI workloads: model and inference endpoint exposure, data boundaries and residency, identity for agents and service principals, secrets handling, and guardrails around AI tooling in the development lifecycle.\nReduce exposure and prove it\nOwn infrastructure vulnerability and exposure management end to end: discovery, prioritization weighing exploitability and reachability alongside severity, ownership routing, remediation tracking, verification. Hosted services and customer-deployed software have different release paths and the practice accounts for both.\nElevate cloud posture and workload protection into a single practice spanning Azure and AWS. You set the platform direction, the coverage standard both clouds are held to, and the path findings take to the teams that own them.\nDrive the decisions on where agentic workflows belong in security engineering: where automation acts and where it recommends, how its output gets verified, and what has to hold true before teams trust it. Where a person still has to act, the finding arrives with owner, fix path, and rationale. Where we can act ourselves, it arrives as a pull request against the module, image definition, or policy that produced it. PRs, not tickets.\nBuild so control evidence can be produced by query. Cloud, configuration, and network controls are assessed under ISO 27001 and SOC 2 today, with IRAP, ACN and PCI self-assessment ahead. A portfolio that keeps growing makes hand-assembled evidence unsustainable.\nWhat we're looking for\nRequired\nTen or more years in security engineering or infrastructure engineering, with substantial time in cloud architecture. Equivalent depth counts.\nDeep cloud security architecture experience across Azure and AWS. Real depth in one, working command of the other.\nHands-on work securing AI workloads or AI-enabled tooling within the last six months. This area moves fast enough that older experience doesn't carry, and we'll ask specifically what you built and when.\nSomething you built that engineering teams adopted and kept using.\nThe three above are the bar. Everything below is depth we'd like and can build. If you meet the requirements and bring most of the rest, apply. We'd rather assess the gap ourselves than have you decide it for us.\nAlso matters: e nough seniority in infrastructure as code to improve on what strong teams already do; network security fundamentals applied to cloud, covering segmentation, private connectivity, egress control, and east-west traffic; container and Kubernetes security, image hardening, supply chain integrity, and secrets management; policy-as-code frameworks and a view on where enforcement belongs in the lifecycle; controls you designed that held up under an audit you were personally accountable for; judgment about which risks to carry and which to escalate.\nHelpful: shipping software customers deploy themselves, FedRAMP or IRAP, a carve-out or large-scale cloud migration.\nWhat you should know going in\nThis is a builder's seat with leadership behind it. You'll set the infrastructure security architecture for a newly independent company, with the backing to build a program rather than the job of holding one together. The work enables engineering directly and opens new markets. If you've wanted to define the direction, this is that seat.\nCompany Description\nOne Identity enables organizations of all sizes to better secure, manage, monitor, protect, and analyse information and infrastructure to help fuel innovation and drive their businesses forward.\nWith team members around the globe, we intend to continue to grow revenues and add value to customers.\nWhen you join our team, you will have the opportunity to build and develop products at a scale few others can provide.\nOur product portfolio serves a large base of customers and we are addressing the strategic imperatives for enterprise businesses.\nWorking with some of the most talented employees the industry has to offer, we provide enhanced career opportunities for team members to learn and grow in a rapidly changing environment.\nWhy work with us?\nLife at One Identity means collaborating with dedicated professionals with a passion for technology.\nWhen we see something that could be improved, we get to work inventing the solution.\nOur people demonstrate our winning culture through positive and meaningful relationships.\nWe invest in our people and offer a series of programs that enables them to pursue a career that fulfills their potential.\nOur team members’ health and wellness is our priority as well as rewarding them for their hard work.\nOne Identity is an Equal Opportunity Employer and Prohibits Discrimination and Harassment of Any Kind: One Identity is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment.\nAll employment decisions at One Identity are based on business needs, job requirements and individual qualifications, without regard to race, color, religion or belief, national, social or ethnic origin, sex (including pregnancy), age, physical, mental or sensory disability, HIV Status, sexual orientation, gender identity and/or expression, marital, civil union or domestic partnership status, past or present military service, family medical history or genetic information, family or parental status, or any other status protected by the laws or regulations in the locations where we operate.\nOne Identity will not tolerate discrimination or harassment based on any of these characteristics. One Identity encourages applicants of all ages.\nCome join us.\nNote: We do not use text messaging or third-party messaging apps like Telegram to communicate with applicants, so please exercise caution if you are approached in this way and only interact with people claiming to be One Identity employees if they have an email address ending in @oneidentity.com.","description_format":"text","description_chars":8629,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Identity Management","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-10T23:25:25Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":3,"expected_fill_days":30,"reasons":["conf:3","win:early"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/one-identity-principal-security-engineer-cloud-and-infrastructure-security","json_url":"https://alion.io/job/one-identity-principal-security-engineer-cloud-and-infrastructure-security.json","meta":{"generated_at":"2026-10-14T07:35:49Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8665,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":9394},"rest":"https://alion.io/mcp/rest/get_company?id=9394"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fone-identity-principal-security-engineer-cloud-and-infrastructure-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fone-identity-principal-security-engineer-cloud-and-infrastructure-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fone-identity-principal-security-engineer-cloud-and-infrastructure-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/one-identity-principal-security-engineer-cloud-and-infrastructure-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fone-identity-principal-security-engineer-cloud-and-infrastructure-security"}]}