Senior Security Engineer, Infrastructure & Automation

Webflow is building the world’s leading AI-native Digital Experience Platform as a remote-first company. They are seeking a Senior Security Engineer, Infrastructure & Automation to enhance their security operations by collaborating with various teams to secure AWS and GCP environments, automate security processes, and improve overall infrastructure security.

Responsibilities:

• Perform infrastructure security reviews across cloud services, network design, IAM, and platform components
• Design, implement, and maintain secure AWS and GCP infrastructure following best practices (least privilege, network segmentation, encryption, monitoring)
• Partner with infrastructure and platform teams to embed security controls in CI/CD pipelines, infrastructure as code, and containerized environments
• Own the cloud security posture management (CSPM) strategy, ensuring continuous compliance and automated detection of misconfigurations
• Collaborate with engineering teams to secure Kubernetes and containerized workloads, ensuring adherence to runtime and image scanning policies
• Respond to and investigate cloud-related security incidents, providing technical expertise during triage and remediation
• Contribute to the design and execution of Webflow’s cloud security roadmap, identifying areas for automation and scalability
• Conduct threat modeling and risk assessments for cloud architecture and new service deployments
• Translate raw findings into actionable engineering fixes, not just tickets or reports
• Design and build internal security services, APIs, and tools that automate infrastructure vulnerability detection, triage, reporting, and remediation
• Develop security automation that integrates with CI/CD, cloud control planes, and developer workflows to shift detection and remediation earlier in the lifecycle
• Experiment with and operationalize agentic and AI-assisted approaches to security detection, analysis, and response as the threat landscape evolves

Requirements:

• 5+ years of experience in cloud security, infrastructure engineering, or security automation (with at least 3 years focused on AWS and GCP)
• Strong knowledge of AWS and GCP services and security controls
• Hands-on experience securing Kubernetes and containerized workloads
• Proficient with infrastructure as code (Pulumi, Terraform, CloudFormation)
• Understand network security concepts including firewalls, segmentation, and zero trust
• 3+ years of automation script authoring for security tasks using Python, Go, Javascript, Typscript, or similar languages
• Comfortable architecting automation solutions using full stack components
• Comfortable operating in ambiguous, fast-changing environments, adapting tooling and approaches as threats and technologies evolve
• Proactive, builder's mindset — identifying and closing gaps before they become issues