Security & Infrastructure Engineer

Required Qualifications

• Professional experience in security engineering, infrastructure/platform engineering, or a closely related technical role — broad competence across security, networking, and operating systems, with real depth in at least one
• Deep hands-on experience with: Security fundamentals — trust boundaries and blast radius, authentication vs. authorization, least privilege, secrets handling, and judging real-world exploitability of findings Networking — diagnosing connectivity issues across routing, firewalls/security groups, DNS, TLS termination, and proxies; comfortable with VPN/private connectivity and packet captures Linux operating systems — processes, filesystems, permissions, systemd, resource limits, log analysis, and how containers relate to the host Cloud infrastructure — hands-on with AWS or GCP beyond the console: IAM, networking, compute, and their failure modes
• Security fundamentals — trust boundaries and blast radius, authentication vs. authorization, least privilege, secrets handling, and judging real-world exploitability of findings
• Networking — diagnosing connectivity issues across routing, firewalls/security groups, DNS, TLS termination, and proxies; comfortable with VPN/private connectivity and packet captures
• Linux operating systems — processes, filesystems, permissions, systemd, resource limits, log analysis, and how containers relate to the host
• Cloud infrastructure — hands-on with AWS or GCP beyond the console: IAM, networking, compute, and their failure modes
• Strong scripting/automation skills (Python, Bash, Go, or similar) — recurring manual work gets scripted away, not tracked by hand
• Strong writing ability: control narratives, runbooks, postmortems, audit responses, risk assessments
• Proven judgment under ambiguity — able to rank findings honestly and defend the ranking
• CS/CE degree or equivalent hands-on experience

Preferred Qualifications

• Hands-on ISO 27001 experience — operating an ISMS, recertification, surveillance audits, internal audit programmes, Statement of Applicability, risk treatment
• SOC 2 experience in practice — producing evidence, answering auditor requests, remediating findings against a real deadline
• Any exposure to AI governance or ISO 42001 — AI risk assessment, model inventory, AI lifecycle controls, the EU AI Act
• Infrastructure as code at scale (Pulumi primarily, Terraform secondarily — deep Terraform experience transfers fine)
• Multi-account cloud organization experience: landing zones, org-level policy guardrails, centralized logging, cross-account access patterns
• Identity provider and endpoint management at scale (Google Workspace or Microsoft 365, SSO/SAML/OIDC, MDM and device compliance tooling)
• Cloud security tooling experience (CSPM, SAST/SCA, vulnerability management platforms), including their false-positive rates
• Container orchestration on ECS, EKS, or Kubernetes
• Observability: metrics, logs, traces, and the judgment to instrument what will matter later
• Experience across both AWS and GCP, including workload identity federation
• Cloud cost awareness — you notice when spend and value diverge
• Startup or high-growth experience building process rather than following one

What Success Looks Like

Why Join Nexxa.ai ?