[Hiring] Cloud Infrastructure Security Engineer @Athyna

Role Description

We’re looking for a Cloud Infrastructure Security Engineer for a short-term contract (a couple of months) with an AI startup that builds environments to train and verify AI agents, focused on securing their cloud environment and closing a backlog of security findings.

If you are methodical, a clear communicator, and hands-on with Terraform and GCP, keep reading!

• 100% Remote
• Salary in USD
• LATAM, Reporting to the United States (PST overlap, flexible hours)
• Full Time (Contract, a couple of months)
• Advanced English

In your day-to-day, you will:

• Review and remediate GCP IAM findings, including personal account access and overly permissive access, managing IAM and organization policies through Terraform.
• Bring in-scope Cloudflare configuration (DNS, WAF, Access, and Zero Trust Gateway) under Terraform, and replace personal API tokens used in automation with appropriately scoped credentials.
• Establish a secure deployment path for internal applications using Cloudflare Access and Okta, with route-level authorization and controls that prevent access to application origins bypassing Cloudflare.
• Triage exposed or unmanaged secrets, coordinate credential rotation, migrate secrets to GCP Secret Manager, and replace long-lived credentials with short-lived ones where supported.
• Harden GitHub Enterprise Cloud, including branch protection, SCIM provisioning, secret scanning, and OIDC-based deployment credentials.
• Send logs from GCP, Cloudflare, GitHub, and Okta to the SIEM and create initial security alerts.
• Investigate and drive remediation of Aikido findings across repositories, virtual machines, containers, and cloud infrastructure.
• Document completed work, provide a runbook for each deliverable, and produce SOC 2 evidence in Vanta.
• Work hands-on against a defined design alongside the internal security team, who keep architecture decisions.

Qualifications

• 5+ years in infrastructure, platform, or security engineering, including 3+ years securing production cloud environments.
• Hands-on GCP security experience, including IAM, organization policies, audit logging, workload identity, and secrets management.
• Strong Terraform experience, including modules, state management, drift, and importing existing resources.
• Hands-on experience with Cloudflare Access and Zero Trust, with familiarity with DNS, WAF, and API token scoping.
• Experience integrating Okta with applications using standards such as SAML, OIDC, and SCIM.
• Experience securing GitHub and CI/CD workflows, including repository controls, secret scanning, and short-lived deployment credentials.
• Experience managing secrets and rotating credentials.
• Working knowledge of Linux, containers, and Kubernetes.
• Ability to read Python or TypeScript, recognize access-control issues, and work with engineers to explain and address them.
• Clear written communication and a commitment to documenting work as part of each deliverable.

Skills that will make you stand out

• GCP VPC Service Controls.
• AWS experience, particularly with Amazon WorkSpaces.
• Experience implementing SOC 2 or ISO 27001 controls.
• SIEM and detection engineering experience.
• Experience securing LLM-backed or agentic systems and data pipelines.
• Experience working in a small security team or as a solo security practitioner at a startup.