Staff Platform Security Engineer

About the role

As a Staff Platform Security Engineer at Phantom, you will be responsible for securing AWS and Kubernetes environments, ensuring the integrity and availability of critical systems. Your work will involve designing security architectures, implementing access controls, and enhancing security automation.

You will collaborate with cross-functional teams to establish platform-security standards and lead initiatives that protect sensitive data and high-value operations. Success in this role means effectively managing security risks while fostering a culture of security across the organization.

The salary range for this position is between $200,000 and $250,000, which reflects the seniority and expertise required.

Skills that matter here

• AWS: You will focus on securing multi-account AWS environments, covering IAM, networking, and logging.
• Kubernetes: Your role involves securing production Kubernetes environments running on Amazon EKS.
• Terraform: You will use Terraform to build reusable security controls and automate configuration validation.
• Pulumi: Pulumi will be utilized for infrastructure and policy as code to enhance security measures.
• TypeScript: You should be able to write production-quality code or automation in TypeScript.
• Python: Python will be one of the languages you can use for automation and security tools.

Who this role suits

• You have a strong background in platform and cloud security with over 7 years of experience.
• You thrive in remote work environments and value flexibility in your work schedule.
• You are proactive, take ownership of security challenges, and communicate effectively with technical teams.
• You have a passion for building and improving security practices in a collaborative setting.

From the employer

• AWS Security: Own and improve security across Phantom’s multi-account AWS environment, including IAM, Identity Center, networking, compute, storage, secrets, logging, and organization-level guardrails.
• Kubernetes Security: Secure production Kubernetes environments running on Amazon EKS, including cluster configuration, workload identity, RBAC, admission controls, network boundaries, secrets, container security, and tenant isolation.
• Identity and Access: Design least-privilege access models for engineers, services, and automation. Build scoped, auditable, and time-bound access paths for sensitive production systems.
• Mission-Critical Systems: Protect the infrastructure supporting products and services that handle sensitive data and high-value operations.
• Cloud Security Architecture: Lead security design for new infrastructure, platform services, and major architectural changes.
• Infrastructure and Policy as Code: Build reusable security controls using tools such as Pulumi, Terraform, Kubernetes policy engines, and automated configuration validation.
• CI/CD and Supply Chain Security: Harden build, deployment, and release systems, including GitHub Actions, workload federation, build runners, dependencies, artifacts, signing, provenance, and access to production environments.
• Security Automation: Build tools that identify and remediate cloud and Kubernetes risks at scale. Apply AI-assisted workflows where they materially improve analysis, coverage, or response speed.
• Cross-Functional Leadership: Partner closely with Infrastructure, SRE, Developer Experience, and product engineering teams. Establish practical platform-security standards and help teams adopt them.

• 7+ years of experience in platform security, cloud security, infrastructure security, security engineering, or a closely related engineering role.
• Deep, hands-on experience securing production AWS environments. You understand IAM and resource policies, workload identity, network security, secrets management, logging, organization-level controls, and the ways these systems fail in practice.
• Deep experience securing Kubernetes in production, preferably Amazon EKS, including RBAC, workload identity, admission policy, network policy, pod security, secrets, and cluster hardening.
• Experience designing or securing mission-critical systems where compromise, excessive privilege, or loss of availability could have significant customer or business impact.
• Strong understanding of identity, authorization, least privilege, isolation, and blast-radius reduction across both human and machine access.
• Experience securing CI/CD and software supply chains, including GitHub Actions or similar systems, build runners, workload federation, artifacts, and production deployment paths.
• Experience writing and reviewing infrastructure as code using Pulumi, Terraform, CloudFormation, or similar tools.
• Ability to write production-quality code or automation in a language such as TypeScript, Python, Go, or Rust.
• High agency and ownership. You can take an ambiguous platform-security problem from initial investigation through implementation and verified remediation.
• Clear communication and a strong track record of partnering with infrastructure and engineering teams while maintaining a high security bar.

• Competitive salary and equity
• Eligibility to participate in the company’s performance bonus program
• Comprehensive medical, dental, and vision insurance with 100% coverage
• Stipend for your ideal remote setup
• Flexible hours and a supportive remote environment
• Unlimited vacation—take time when you need it
• 401(k) retirement plan
• Monthly wellness benefit
• Weekly meal benefit
• Global off-sites