Infrastructure as Code (IaC) Security Engineer

You will work closely with Application Security, Cloud Engineering, Platform Engineering, and Development teams to identify and prevent infrastructure misconfigurations before deployment. Success in this role requires balancing strong security controls with a frictionless developer experience while maintaining high platform reliability and low operational noise. What You’ll Do Security Policy Engineering

• Design, develop, and maintain custom security policies using OPA/Rego to extend IaC security coverage beyond out-of-the-box capabilities.
• Translate internal security standards, compliance requirements, and cloud governance guardrails into scalable policy-as-code frameworks.
• Implement version-controlled policy packages and establish governance processes for policy lifecycle management.

CI/CD Security Integration

• Integrate Wiz security scanning into CI/CD platforms including Azure DevOps, GitHub, GitLab, and Jenkins.
• Implement automated security gates and enforcement strategies using phased rollout models (Report Warn Block).
• Optimize scan performance, concurrency, and developer feedback loops to minimize pipeline impact.

Platform Operations & Reliability

• Monitor and maintain IaC security tooling, ensuring high availability and operational excellence.
• Manage Wiz CLI upgrades, scanner integrations, policy bundle updates, and CI/CD plugin maintenance.
• Develop regression testing frameworks to validate policy quality and prevent disruption during changes.

Security Findings Management

• Triage, validate, and prioritize IaC findings across large-scale environments.
• Reduce false positives through continuous tuning and policy refinement.
• Automate ownership routing, exception management, and remediation workflows.
• Maintain compliance evidence, exception records, and audit-ready documentation.

Developer Experience & Enablement

• Enable developers through pull request scanning, local development workflows, and IDE integrations.
• Provide actionable remediation guidance, reusable templates, and secure coding best practices.
• Facilitate office hours, training sessions, and support channels to accelerate adoption of secure infrastructure practices.
• Partner with platform teams to embed security into standardized pipelines and reusable infrastructure modules.

Governance & Reporting

• Integrate with ServiceNow workflows to support ticket synchronization, SLA tracking, and security lifecycle management.
• Deliver operational metrics and executive reporting, including:
• Security coverage
• Policy adoption
• Block rates
• Mean Time to Resolution (MTTR)
• False positive trends
• Exception aging
• Support audit requests with policy mappings, change records, and governance documentation.

• Bachelor’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
• 8+ years of experience in Application Security, Cloud Security, DevSecOps, or related security engineering roles.
• Hands-on experience securing Terraform and Kubernetes environments.
• Experience implementing and operating Wiz or comparable cloud security and IaC security platforms.
• Strong understanding of Policy as Code, including practical experience with OPA/Rego or similar frameworks.
• Experience integrating security controls within CI/CD pipelines and modern software delivery practices.
• Strong analytical and troubleshooting skills with the ability to manage security findings at scale.
• Excellent written and verbal communication skills with a demonstrated ability to influence and enable engineering teams.

Preferred Qualifications

• Experience integrating security workflows with ServiceNow AVR/CVR/ITSM or similar governance platforms.
• Experience supporting developer tooling and IDE integrations, including VS Code.
• Cloud certifications such as AWS, Azure, or Google Cloud Professional certifications.
• HashiCorp Terraform Associate certification.
• Kubernetes certifications such as CKA or CKAD.
• Automation and scripting experience using Python, Bash, or PowerShell.
• Experience building developer-focused security programs within large enterprise environments.

Technologies

• Cloud Security: Wiz
• Infrastructure as Code: Terraform, ARM/Bicep, CloudFormation, Kubernetes, Helm
• CI/CD & Source Control: Azure DevOps, GitHub, GitLab, Jenkins
• Policy as Code: OPA, Rego
• Workflow & Governance: ServiceNow
• Automation: Python, Bash, PowerShell