Principal Infrastructure Security Engineer

Zeta Global•San Francisco, CA

1d•$220,000 - $240,000

About The Position

This is a hands-on Principal Infrastructure Security role within Zeta Global’s DevSecOps practice, focused on strengthening security across primarily AWS-based infrastructure and software delivery. The role partners with Application Security (AppSec) and Information Security (InfoSec) to prevent security issues and respond effectively when they arise. It is a player-coach position, setting strategy while remaining closely involved in technical work.

Requirements

10+ years of combined experience in software, platform/DevOps, and security engineering.
3+ years of experience as a technical lead.
Experience leading cross-functional security or infrastructure initiatives and influencing engineering, DevOps/platform, AppSec, and InfoSec teams.
Hands-on AWS security and IAM experience, including least privilege, service identities, privileged access, encryption, and networking/security boundaries.
Experience automating controls with scripting, IaC, CI/CD, and policy-as-code.
Experience securing delivery pipelines end to end, including IaC, CI/CD, containers, dependencies/artifacts, and secrets.
Experience prioritizing vulnerabilities by risk and establishing ownership, escalation, exception, and remediation workflows.
Experience in security incident investigation, containment, recovery, and post-incident improvement.
Ability to communicate risk and tradeoffs to leadership.

Nice To Haves

Experience building a security/DevSecOps practice and hiring, developing, or managing engineers.
Kubernetes/container security experience.
Experience with software supply chain security and secure SDLC practices.
Experience partnering with InfoSec/SOC on security observability and detection.
Experience selecting security tools, managing vendors and budgets, and measuring control coverage, risk reduction, and remediation progress.
Familiarity with public-company or regulated audit controls such as SOX, SOC 2, or ISO 27001.

Responsibilities

Define and execute a risk-based DevSecOps roadmap, establishing ownership, metrics, escalation paths, and a plan to grow the team.
Implement preventive AWS controls for identity, networking, encryption, secrets and key management, and cloud configuration; ensure security-relevant activity is logged for monitoring, investigation, and audit.
Embed security into infrastructure as code (IaC), CI/CD, containers and orchestration, and software supply chains, including SCA, secrets scanning, artifact integrity and signing, SBOMs where appropriate, and automated pipeline controls such as SAST, IaC/container scanning, and policy-as-code.
Partner with AppSec and InfoSec on security testing, policy, risk, audit evidence, and incident response.
Triage and prioritize vulnerabilities by exposure, exploitability, and business impact; coordinate remediation, track exceptions, and support investigation, containment, recovery, and post-incident improvement.