SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Nexxa.ai is building autonomous AI systems for heavy industries—manufacturing, infrastructure, and logistics. This Security & Infrastructure Engineer role owns the security and compliance foundation that enables customers to trust and deploy the platform at scale.
You will own compliance programs across SOC 2 Type 2 and ISO 27001 certifications, including evidence collection, access reviews, control monitoring, internal audits, and audit readiness. You'll triage and remediate security findings across cloud posture, code scanning, dependencies, and secrets, implementing fixes directly in infrastructure as code, IAM policy, and CI/CD pipelines.
Responsibilities include administering identity and access across AWS, GCP, and SaaS platforms (SSO/federation, least-privilege roles, joiner/mover/leaver lifecycle); supporting internal IT operations (endpoint fleet, device compliance, asset inventory) while keeping manual overhead flat as the company scales; serving as the working interface to external auditors and customer security reviews; and hardening the CI/CD pipeline and software supply chain through identity, artifact provenance, and dependency hygiene.
You'll debug production issues across cloud infrastructure, containers, and networking, write postmortems, and produce documentation (runbooks, control narratives, architecture notes) that others rely on. The role emphasizes building controls that hold automatically—designing guardrails that fail closed rather than relying on recurring manual verification.
This is an ideal fit for someone who wants real, ongoing ownership of a security function at a company where trust and compliance directly determine customer adoption. You'll help define the next phase of the security program, not just execute known tasks.
REQUIREMENTS:
- Professional experience in security engineering, infrastructure/platform engineering, or closely related technical role with broad competence across security, networking, and operating systems, and real depth in at least one
- Deep hands-on experience with: security fundamentals (trust boundaries, blast radius, authentication vs. authorization, least privilege, secrets handling, exploitability judgment); networking (routing, firewalls/security groups, DNS, TLS, VPN, packet captures); Linux operating systems (processes, filesystems, permissions, systemd, resource limits, log analysis, containers); cloud infrastructure (AWS or GCP beyond console: IAM, networking, compute, failure modes)
- Strong scripting/automation skills (Python, Bash, Go, or similar)
- Strong writing ability for control narratives, runbooks, postmortems, audit responses, risk assessments
- Proven judgment under ambiguity—able to rank findings honestly and defend the ranking
- CS/CE degree or equivalent hands-on experience
PREFERRED QUALIFICATIONS:
- Hands-on ISO 27001 experience (ISMS operation, recertification, surveillance audits, internal audit programs, Statement of Applicability, risk treatment)
- SOC 2 Type 2 experience in practice (evidence production, auditor requests, remediation under deadline)
- Exposure to AI governance or ISO 42001 (AI risk assessment, model inventory, AI lifecycle controls, EU AI Act)
- Infrastructure as code at scale (Pulumi, Terraform)
- Multi-account cloud organization experience (landing zones, org-level policy guardrails, centralized logging, cross-account access)
- Identity provider and endpoint management at scale (Google Workspace, Microsoft 365, SSO/SAML/OIDC, MDM, device compliance)
- Cloud security tooling (CSPM, SAST/SCA, vulnerability management, false-positive awareness)
- Container orchestration (ECS, EKS, Kubernetes)
- Observability (metrics, logs, traces, instrumentation judgment)
- Experience across both AWS and GCP, including workload identity federation
- Cloud cost awareness
- Startup or high-growth experience building process
