Infrastructure Security Engineer

Opendoor•Miami, FL

144d•Onsite

About The Position

Opendoor’s Security Engineering team builds intelligent systems to protect the company and its customers while enabling engineering velocity, applying software engineering and AI to security across product, infrastructure, and operations. The Infrastructure Security Engineer owns the security of Opendoor’s production environment, including multi-account AWS, Kubernetes clusters, Terraform-managed infrastructure, the identity plane, and cloud workloads supporting the company’s business operations. The role offers meaningful work already underway and the opportunity to define future direction. The engineer develops and operates cloud security visibility and protection, zero-trust access, Kubernetes hardening, cloud detection engineering, and shift-left security in engineering pipelines. The role also builds agentic detection and response workflows, partners with Infrastructure on cloud-native security decisions, establishes secure-by-default patterns for AI-enabled engineering, and mentors engineers by turning security patterns into automated guardrails. The role is based in one of Opendoor’s talent hubs, with an in-office culture and an expectation of working in the office five days a week. The stated required in-office days are Monday, Tuesday, Thursday, and Friday.

Requirements

Demonstrated conviction that AI and automation should eliminate manual work and increase team impact, with a track record of building agentic systems that replaced reactive security work.
Ability to operate autonomously in ambiguous environments and define effective practices without an established playbook.
A business-enablement security mindset that measures success by business impact and informed risk-taking rather than tickets or compliance checklists.
Cloud or infrastructure security experience and deep AWS expertise, including interpreting CloudTrail events, writing service control policies, and assessing identity trust policies.
Strong skills in at least one of Go, Python, or TypeScript, and ability to read and write Terraform and shell scripts.
Hands-on Kubernetes security experience, including RBAC, network policies, admission control, workload identity, and image and supply-chain security.
Experience deploying and operating cloud posture and workload protection tooling, such as Wiz, Prisma, Orca, Datadog, CrowdStrike Falcon Cloud, Lacework, or equivalent.
An identity-first security mindset and demonstrated ability to build identity and access management solutions at scale.
Humility, genuine curiosity, and a collaborative approach to enabling product and infrastructure engineers.

Nice To Haves

Experience designing or operating Zero Trust Network Access, such as Cloudflare Access, Tailscale, Twingate, or Google BeyondCorp.
Detection engineering experience with threat modeling and an adversarial mindset, including writing practical detections that avoid excessive noise.
Experience securing AI and machine learning pipelines, agent frameworks, or MCP-style integrations that access production data.
Familiarity with SOC 2, SOX, or other cloud compliance frameworks, and judgment about when compliance work creates real security value.
Open-source contributions to cloud security tooling such as Cartography, Prowler, ScoutSuite, Falco, Kyverno, Open Policy Agent, or Checkov.

Responsibilities

Own the security architecture of the production cloud environment, including AWS accounts, Kubernetes clusters, Terraform-managed infrastructure, and the identity plane.
Evaluate, build, and operate cloud security visibility and protection platforms, integrating them into engineering workflows to automate remediation of infrastructure risks.
Define and drive a zero-trust access strategy using device trust and identity-aware proxies.
Harden Kubernetes through RBAC, admission policies, workload identity, runtime protection, image signing, and base-image strategy.
Build agentic detection and response workflows using AWS-native services to connect alerts with investigation and remediation.
Drive shift-left cloud security in pipelines using Terraform/Terrakube, GitHub Actions, and Elastic Container Registry.
Partner with the Infrastructure team on VPC architecture, ingress, secrets management, service identity, and Okta integration across AWS, Azure, and GCP.
Operate cloud detection engineering using GuardDuty, Security Hub, CloudTrail, and VPC Flow Logs, tuning for signal and integrating with Datadog and incident response playbooks.
Establish secure-by-default practices for AI-enabled engineering, including applications, MCP servers, and agent-driven workflows that access production cloud infrastructure.
Mentor engineers on cloud security patterns and convert those patterns into automated guardrails.