Senior Security Engineer

MuleSoft Security Engineering protects the Anypoint Platform and the infrastructure it runs on. As a Senior Security Engineer focused on infrastructure, you will design, build, and operate identity, network, and cloud security controls in AWS.

Core Responsibilities & Scope

• Implement and maintain security controls that satisfy FedRAMP requirements, mapped to NIST SP 800-53.
• Engineer secure network architecture in AWS: VPC design, segmentation, security groups, NACLs, Transit Gateway, PrivateLink, WAF, and egress controls.
• Design and improve identity and access management: IdP integration, SSO, federation (SAML, OIDC, OAuth), IAM roles and policies, least privilege, privileged access, secrets management, and KMS key management.
• Build and maintain infrastructure as code in Terraform, including reusable modules, secure defaults, policy-as-code, and automated guardrails.
• Harden and secure Linux systems and containers, including host baselines, runtime security, and Kubernetes workloads.
• Support continuous monitoring: vulnerability remediation within required timelines, POA&M tracking, and evidence collection for audits.
• Automate control validation and evidence gathering.
• Partner with Engineering, SRE, and Compliance to embed security into the SDLC and deployment pipelines.
• Contribute to incident response and detection engineering, including logging, SIEM integration, and alerting.
• Produce clear technical documentation and architecture reviews, and mentor other engineers.

Minimum Requirements

• 5+ years in security engineering, cloud security, or infrastructure security.
• Experience implementing and meeting security controls in a FedRAMP environment, or an equivalent framework (for example, NIST 800-53, NIST 800-171, or CMMC).
• Solid knowledge of NIST security controls, including control families, baselines, and how to map them to technical implementations.
• Strong, hands-on Terraform skills, including module design, state management, and CI/CD-driven deployments.
• Deep experience with network security engineering in AWS (VPC, Transit Gateway, security groups, WAF, GuardDuty, Security Hub, Config, CloudTrail).
• Hands-on identity engineering: IdPs, SAML, OIDC, OAuth 2.0, and directory and authentication protocols (LDAP, Kerberos), plus AWS IAM and KMS.
• Strong understanding of TLS and PKI, including certificate lifecycle management and secure protocol configuration.
• Strong Linux systems and container experience.
• Proficiency in a scripting language (Python, Go, or Bash).
• Strong written and verbal communication, including working with auditors and engineering teams.
• U.S. citizenship and the ability to work from the U.S., as required by federal regulation for access to the FedRAMP environment.

Preferred Qualifications

• Practical experience using AI tools to accelerate engineering work, with sound judgment in reviewing AI-generated code and configurations for security.
• Experience supporting a FedRAMP authorization, annual assessment, or 3PAO assessment.
• Experience with Kubernetes security at scale.
• Working knowledge of vulnerability management, patching, and remediation workflows.
• Familiarity with FIPS 140-2/140-3 validated cryptography.
• Experience with AWS GovCloud.
• Experience with FedRAMP 20x, continuous monitoring automation, OSCAL and/or similar frameworks and technologies.
• Familiarity with CISA directives and DISA STIGs.
• Experience with policy-as-code (OPA, Sentinel, Checkov) and software supply chain security.
• Certifications such as AWS Security Specialty, CKS, CCSP or similar is preferred.

What Success Looks Like

• First 90 days: You understand the infrastructure architecture and control inventory, and you own remediation of a defined set of control gaps.
• 6 months: You deliver network and identity security improvements through Terraform and automate at least one control validation workflow.
• 12 months: You are a recognized technical authority for AWS infrastructure security and compliance, and you help keep the team audit-ready.