Security Infrastructure Engineer

Engineering at Ada

As an Ada engineer, you'll have the autonomy to make a huge impact and the opportunity to work alongside talented peers who challenge and inspire you. We move fast, take ownership, and always strive to improve, both as individuals and as a team. As a Security Infrastructure Engineer on Ada's Security Operations team, your work will have a fundamental impact on Ada's growth: our customers put an AI agent in front of their customers, and it has to be trustworthy by construction.

Our Role

We are looking for a Security Infrastructure Engineer to own cloud and platform security end to end, architecture, detection and response, and platform enablement across AWS and Azure, including the security of our agentic AI platform. This role is not focused on ticket-driven security work: you will replace manual security work with platform capabilities, build guardrails into the product itself, and set the security bar across Product Development. You will operate with a high degree of autonomy, set technical direction that other senior engineers follow, mentor security engineers, and act as the senior technical counterpart to engineering and security leadership translating risk and compliance requirements into concrete engineering solutions.

About You

• 8+ years of experience in cloud, infrastructure, or security engineering roles, including experience setting technical direction across multiple teams, not just executing within one.
• Deep hands-on experience with at least one major cloud provider, preferably AWS; Azure experience is a plus.
• Strong experience designing and securing cloud IAM, networking, secrets management, and distributed systems at scale.
• Extensive experience with infrastructure as code (Terraform or CloudFormation) and policy as code; you default to automation and preventative controls over manual review.
• Experience building or operating detection and response systems including SIEM, CSPM/CIEM, and cloud security monitoring.
• Experience with or a strong point of view on securing LLM and agentic AI systems: guardrails, safe tool use, and failure isolation.
• A track record of turning recurring security and infrastructure requests into self-serve tooling, retiring ticket queues rather than staffing them.
• Proven ability to translate compliance and risk requirements into technical implementations.
• Strong communicator who can influence architecture and engineering decisions across teams, and mentor senior engineers through design reviews and hands-on guidance.
• Comfortable operating independently, owning long-term technical initiatives, and carrying a share of security-relevant on-call.

What You Will Do

Cloud Security Architecture & Engineering

• Architect, design, and operate security technologies across cloud, network, identity, endpoint, and application layers in public, private, and hybrid environments.
• Define cloud security reference architectures, threat models, and guardrails aligned with zero trust and least privilege principles.
• Own the technical lifecycle of security tooling including cloud-native security services, SIEM, CSPM, CIEM, EDR, DLP, and vulnerability management platforms.

Agentic Platform Security

• Build safety guardrails into the platform itself so failures like an agent bypassing a playbook safeguard cannot reach a customer.
• Partner with the Reasoning Engine and Playbooks teams on agent behavior that is safe by construction.
• Set the security bar inside Product Development: secure-coding standards, review practice, and threat modeling for new agentic features.

Detection, Response & Automation

• Stand up security observability: detection, alerting, and response for the platform, wired into Datadog and Sentry alongside the wider observability push.
• Engineer automated response and remediation workflows using cloud-native automation, SOAR, and infrastructure as code.
• Lead cloud security incident investigations, carry a share of security-relevant on-call, and feed every incident back into tooling so it does not recur.

Self-Serve Security Enablement

• Turn recurring security and infra requests (access provisioning, environment setup) into self-serve tooling — retire the ticket queue rather than staff it.
• Embed security into CI/CD pipelines, platform tooling, and deployment workflows using policy as code and automated guardrails, so engineering teams ship faster without compromising security.

Governance, Risk & Compliance Enablement

• Translate security and regulatory frameworks (NIST SP 800-53, PCI DSS, CIS Benchmarks, AWS Well-Architected) into enforceable technical controls.
• Lead the engineering side of vendor and dependency security: reviews, least-privilege access, and cutting overlapping tools from the stack.
• Support audits, risk assessments, and evidence collection with internal compliance and external assessors.

Technical Leadership

• Serve as the subject matter expert for cloud and platform security and its relationship to Ada's business-critical systems.
• Mentor security and platform engineers through documentation, design reviews, and hands-on guidance.
• Operate with high autonomy, making architectural decisions that shape long-term security posture and platform scalability.

Outcomes

• Own secure-by-default infrastructure for the agentic platform across AWS and Azure: identity, secrets management, network boundaries, and access control.
• Establish a secure-by-default cloud security architecture that scales with Ada’s growth, reducing risk through automation and preventative controls.
• Close the guardrail gaps that could let unauthorized agent actions reach a customer.
• Improve detection, response, and incident readiness across cloud environments.
• Enable engineering teams to ship faster without compromising security, and raise the bar for security engineering maturity across the organization.
• First 90 days: map the current attack surface and access model, ship one self-serve replacement for a high-volume manual security request, and close the guardrail gap that let unauthorized actions through.

#LI-NS1