Principal Security Engineer Cloud and Infrastructure Security
One Identity
IndiaremotePosted 16 days ago
Skill Required
Principal-Security-EngineerCloud-Security-EngineerInfrastructure-Security-EngineerSecurity-ArchitectSecurity-EngineerSenior-Cloud-Infrastructure-Security-EngineerPrincipal-Cloud-Security-ArchitectSenior-Principal-Security-EngineerPrincipal-Information-Security-EngineerSenior-Cloud-Security-ArchitectCloud EngineerInfrastructure EngineerSecurity EngineersecurityCloudandCloud SecurityEngineeringKubernetesISO 27001automationbuildingdesignAzurejQueryAWSAIFulltime
Key highlights
- Required Experience: 10+ years in security or infrastructure engineering
- Key Requirement: Hands-on AI workload security within the last 6 months
- Key Requirement: Deep architecture experience in both Azure and AWS
- Notable Benefit: Opportunity to set the architecture for a newly independent company
Role overview
One Identity is seeking a Principal Security Engineer for Cloud and Infrastructure Security to serve as the senior technical voice for a lean, globally distributed team. This role is responsible for shaping the security architecture across Azure and AWS, which directly impacts the certifications the company can hold and the markets it can enter as it separates from Quest Software to build an independent security function. The role involves securing both the hosted services One Identity operates and the base images and deployment defaults published for customers to deploy in their own datacenters. It is a builder's seat designed for someone who wants to define the direction of infrastructure security architecture for a newly independent company.
Responsibilities
- Own security architecture across Azure and AWS: tenant, subscription and account design, network segmentation and traffic control, private connectivity, egress policy, workload isolation.
- Identify when regulated markets or certifications constrain a design before it is committed.
- Run One Identity products against real security requirements and provide feedback to the teams building them.
- Bring engineering into architectural decisions early to ensure designs hold up in production.
- Raise the security ceiling for infrastructure as code practices through hardened modules, secure-by-default landing zones, account baselines, and preferred patterns.
- Extend policy as code across the pipeline and the platform to provide signals at commit time.
- Own the hardened image pipeline for virtual machines and containers for both internal fleets and published images, covering build, patch cadence, provenance, signing, and automation.
- Secure the container orchestration layer, including reference architecture and secure defaults for customers deploying products on their own clusters.
- Set the security architecture for AI workloads, including model and inference endpoint exposure, data boundaries and residency, identity for agents and service principals, secrets handling, and guardrails around AI tooling in the development lifecycle.
- Own infrastructure vulnerability and exposure management end to end: discovery, prioritization (weighing exploitability and reachability alongside severity), ownership routing, remediation tracking, and verification for both hosted services and customer-deployed software.
- Elevate cloud posture and workload protection into a single practice spanning Azure and AWS, setting platform direction, coverage standards, and the path for findings.
- Drive decisions on agentic workflows in security engineering: determining where automation acts vs. recommends, verification of output, and trust requirements.
- Ensure findings arrive with owner, fix path, and rationale for human action, or as a pull request against the module, image definition, or policy for automated action.
- Build systems so control evidence for ISO 27001, SOC 2, IRAP, ACN, and PCI self-assessment can be produced by query.
Requirements
- Ten or more years in security engineering or infrastructure engineering, with substantial time in cloud architecture (or equivalent depth).
- Deep cloud security architecture experience across Azure and AWS, with real depth in one and working command of the other.
- Hands-on work securing AI workloads or AI-enabled tooling within the last six months.
- A track record of building something that engineering teams adopted and kept using.
- Seniority in infrastructure as code to improve upon existing strong team practices.
- Network security fundamentals applied to cloud, covering segmentation, private connectivity, egress control, and east-west traffic.
- Container and Kubernetes security, image hardening, supply chain integrity, and secrets management.
- Experience with policy-as-code frameworks and a perspective on where enforcement belongs in the lifecycle.
- Experience designing controls that held up under an audit for which the candidate was personally accountable.
- Judgment regarding which risks to carry and which to escalate.
Nice to have
- Experience shipping software that customers deploy themselves.
- Experience with FedRAMP or IRAP.
- Experience with a carve-out or large-scale cloud migration.
Benefits
- Enhanced career opportunities to learn and grow in a rapidly changing environment.
- Investment in people through a series of programs to pursue fulfilling career potential.
- Priority on team members’ health and wellness.
Additional details
- Role: Principal Security Engineer Cloud and Infrastructure Security
- Company: One Identity · Information Security, Attack Surface
- Level: Principal individual contributor
- Location: India
- Reporting Line: Reports to the Director of Information Security
- Company Mission: One Identity enables organizations of all sizes to better secure, manage, monitor, protect, and analyse information and infrastructure.
- Equal Opportunity Employer: One Identity prohibits discrimination and harassment of any kind based on race, color, religion, national origin, sex, age, disability, sexual orientation, gender identity, etc.
- Security Note: The company does not use text messaging or third-party apps like Telegram to communicate with applicants; official communication comes from @oneidentity.com emails.