Senior Security Engineer

Guidewire is a cloud platform provider for property and casualty insurers, combining digital, core, analytics, and AI capabilities. Guidewire is seeking a Senior Security Engineer to design, operate, and improve AWS-focused cloud infrastructure and CI/CD supply-chain security controls, while addressing emerging areas such as AI security. The role partners across engineering, operations, security, and business teams to automate controls, manage risk, and mentor engineers.

Responsibilities:

• Lead complex infrastructure security initiatives involving multiple teams, systems, and dependencies, with a primary focus on AWS cloud environments and CI/CD pipelines
• Design, implement, and operate security controls across AWS and applicable cloud platforms
• Build secure-by-default solutions using infrastructure as code, policy as code, CI/CD, and automation
• Improve cloud governance, security posture, and operational resilience through controls for cloud organization and account structure, access management integration, policy enforcement, logging and monitoring, data protection, configuration management, network security, and account lifecycle management
• Define and maintain security baselines for cloud accounts, operating systems, containers, AMIs, Kubernetes, networks, and supporting infrastructure
• Support cloud account onboarding, offboarding, inventory, configuration drift management, exception handling, and control validation
• Design and improve cloud and infrastructure network security, including network segmentation, traffic visibility, ingress and egress control, DNS, firewalls, routing, private connectivity, and related monitoring and enforcement mechanisms
• Secure CI/CD and software supply chains, including build and deployment workflows, dependencies, artifacts, containers, registries, third-party actions, secrets, and runner environments
• Support asset and identity governance for applications, infrastructure, containers, service accounts, workload identities, API keys, AI agents, and MCP tools
• Participate in AI security initiatives involving next-generation AI models, agents, and tool integrations (including Model Context Protocol / MCP), driving threat modeling, prompt injection defenses, data egress protection, guardrails, human-in-the-loop controls, monitoring, and leveraging AI models to automate and enhance security operations
• Apply risk-based security analysis using reachability, attack paths, asset criticality, exploitability, and business impact—not severity alone
• Validate scanning-tool and AI-generated findings, establish ownership and remediation expectations, and improve finding quality feedback loops
• Represent Security in architecture, change management, design review, and operational forums
• Communicate risks, trade-offs, assumptions, dependencies, and business impact to technical and non-technical audiences
• Create standards, runbooks, architecture decision records, dashboards, documentation, and enablement materials
• Mentor engineers and help partner teams adopt secure patterns without requiring direct management responsibility
• Participate in on-call rotations and incident response support for cloud and infrastructure security incidents
• Monitor emerging threats and translate relevant developments into practical improvements to Guidewire’s security controls

Requirements:

• Typically 5+ years of experience in security engineering, cloud security, infrastructure security, DevSecOps, or equivalent practical experience
• Hands-on experience designing and operating secure AWS environments is required
• Experience designing or operating cloud security capabilities, including cloud governance, access management integration, policy enforcement, logging and monitoring, data protection, network security, configuration management, and cloud account lifecycle controls
• Hands-on experience authoring, reviewing, testing, and troubleshooting infrastructure-as-code using Terraform, CloudFormation, or comparable technologies to deploy and manage security controls
• Hands-on experience building, securing, testing, and operating CI/CD pipelines, preferably using GitHub Actions or comparable platforms, including pipeline automation, secrets management, artifact handling, and runner security
• Hands-on scripting or programming experience, using Python, Go, or another appropriate language, to automate security tasks, integrate controls, and troubleshoot security tooling
• Practical knowledge of cloud and infrastructure networking, including segmentation, routing, DNS, firewalls, ingress and egress controls, private connectivity, and network telemetry
• Experience securing containers and Kubernetes platforms, preferably EKS or an equivalent platform
• Knowledge of threat modeling, secure design, vulnerability management, security testing, risk assessment, monitoring, and incident response
• Ability to evaluate security-control effectiveness using evidence, operational feedback, exceptions, findings, and relevant metrics
• Demonstrated experience building, operating, or contributing to security measurement and analysis capabilities, such as asset inventories, control-coverage reporting, configuration-drift analysis, attack-path analysis, or security data platforms
• Working knowledge of identity and access-control concepts, including authentication, authorization, privileged access management, identity governance, zero-standing privilege, workload and non-human identities, and secrets management, with the ability to apply these concepts when evaluating, designing, implementing, or measuring controls across cloud, infrastructure, CI/CD, and operational workflows
• Working knowledge of software supply-chain security concepts, including SBOMs, artifact signing, provenance, dependency management, secure registries, and CI/CD runner hardening, with the ability to evaluate, design, implement, or measure related controls and automation
• Working knowledge of foundational AI security concepts (e.g., LLM risks, prompt safety) and an eagerness to apply AI capabilities to security automation
• Ability to own complex work, manage ambiguity, make trade-offs, identify risks, and deliver outcomes across multiple teams
• Strong written and verbal communication skills, including the ability to explain complex security concepts in business terms
• Experience with Google Cloud Platform (GCP) is strongly preferred; experience with other cloud platforms is a plus
• Hands-on experience or deep knowledge of AI-security risks and controls, including LLMs, AI agents, MCP, AI gateways, prompt injection defense, sensitive-data leakage, and applying advanced AI models/tools to improve security operations
• Familiarity with NIST AI RMF, OWASP LLM Top 10, MITRE ATLAS, ISO/IEC 42001, or comparable frameworks
• Relevant certifications such as AWS Security Specialty, CISSP, GIAC, or equivalent practical expertise