Senior Infrastructure Security Software Engineer (Remote)

Quora is a privately held, remote-first company focused on growing the world's collective intelligence through its knowledge-sharing platform and AI models. They are seeking a Senior Infrastructure Security Software Engineer to join their Security Engineering Team, responsible for building protections around their products and infrastructure while addressing security challenges.

Responsibilities:

• Partner with engineering teams to review cloud and compute architecture design changes
• Establish threat models for cloud and compute paved roads to identify security risks
• Develop or adopt open-source tools to monitor and harden our cloud Infrastructure, harden our OS, develop security logging pipelines and detect intrusions
• Apply your expert knowledge of security best practices for AWS and Kubernetes to inform remediations and the team's control roadmap
• Drive the definition and implementation of security policies and monitor in conformance to the policies
• Write code for automations that support security requirements like threat detection, incident containment, and network access management
• Conduct initial incident triage; determine scope, urgency, and potential impact of security incidents; participate in the incident response process

Requirements:

• You have hands-on experience securing large-scale cloud environments, particularly with AWS
• You are passionate about building secure infrastructure-as-code (IaC) pipelines using tools like Terraform or CloudFormation
• You understand IAM policies, network segmentation, and VPC design and have a thorough grasp of monitoring and logging in cloud-native environments
• You are skilled in identifying misconfigurations, mitigating risks, and driving remediation processes
• You believe in 'security as code' and are skilled at automating security processes
• You can develop and integrate security tools into CI/CD pipelines to ensure secure code delivery
• Tools like SAST, DAST, and dependency scanning are part of your daily toolkit, and you have experience integrating them into workflows to catch vulnerabilities early
• You also advocate for secure coding practices and are skilled at mentoring teams to write resilient, secure applications
• You are well versed in AWS infrastructure security but also are passionate about scalability, reliability and operational rigor
• You know that root does not mean root and are passionate about container security, POSIX Capabilities, SECCOMP and have a favorite flavor of LSM
• You love playing around with OSQuery and eBPF
• You will partner with engineering teams to review cloud and compute architecture design changes
• You will establish threat models for cloud and compute paved roads to identify security risks
• You will develop or adopt open-source tools to monitor and harden our cloud Infrastructure, harden our OS, develop security logging pipelines and detect intrusions
• You will apply your expert knowledge of security best practices for AWS and Kubernetes to inform remediations and the team's control roadmap
• You will drive the definition and implementation of security policies and monitor in conformance to the policies
• You will write code for automations that support security requirements like threat detection, incident containment, and network access management
• You will conduct initial incident triage; determine scope, urgency, and potential impact of security incidents; participate in the incident response process
• Experience building secure web applications and APIs, with a working grasp of the OWASP Top 10 and common vulnerabilities such as XSS, CSRF, and SQL injection