Senior AI Platform Security Engineer - Contract to Hire

Front • San Francisco, CA

2d • $187,000 - $250,000 • Hybrid

About The Position

Front is building a serious amount of software for itself. GTM Engineers are shipping internal tools and AI agents on top of Salesforce, Gong, Snowflake, Workato, Notion and Claude — automations that our revenue teams now depend on to do their jobs. That software needs somewhere reliable and secure to run. You'll decide how internal software at Front gets built, deployed, secured and operated — the standards, the reference architecture, the review bar — and then you'll implement them yourself and keep them alive as the estate grows. There is no separate team to hand a standards document to. Writing it and building it are the same job. We're hiring for opinions. If you've built a platform practice from nothing before and have views on what good looks like — where to put the guardrails, which conventions are worth enforcing, what to automate before it becomes a habit — we want to hear them in the interview, not after you start. Strong opinions include knowing when to adopt rather than invent: you'll partner closely with our product engineering org and take what already works there. Your users are other engineers, and your job is measured by how fast and safely they can move. You'll report into Corporate IT and work day to day alongside the GTM Systems, Data and product engineering teams whose tooling and engineers the platform depends on.

Requirements

• You've established a platform, DevOps or infrastructure practice somewhere it didn't exist — as a founding platform engineer, an early infra hire, or the person who dragged a team onto real standards. You can point at conventions still in use that you wrote.
• Deep hands-on experience running production infrastructure in a major cloud — networking, IAM, compute, and the failure modes of each.
• Infrastructure as code in production at scale: Terraform, Pulumi, CloudFormation or equivalent, including inheriting and refactoring someone else's modules.
• Owning CI/CD pipelines end to end, including test, scan and deploy gates. Containers and orchestration.
• Strong Python or Go for automation, tooling and debugging systems you didn't write.
• Practical infrastructure security: cloud configuration hardening, secrets management, dependency and vulnerability management, and least-privilege access design.
• Clear written communication, and the judgment to know when a standard should be enforced in a pipeline versus argued in a room. You'll be writing documentation engineers actually use and explaining risk to non-technical stakeholders.
• Strong SQL experience, ability to write queries within Snowflake and other BI tools.
• Hands-on security operations experience: log and audit analysis, alert triage, real incident response. Experience reviewing events within a SIEM.
• Experience with implementing and managing SAML/OIDC SSO and SCIM on internal-built tools and integrating such tools with identity providers such as Okta.
• Strong experience with secrets management, including OAuth, API, and JWT service account based integrations.
• Production iPaaS experience including repairing integrations you didn't write.
• Bias towards documentation — if you do something, write it down for others to reference.

Nice To Haves

• Experience building an internal developer platform, or otherwise being on the team whose customers are other engineers.
• Experience operating LLM or agent infrastructure in production — MCP servers, RAG pipelines, semantic layers, or AI tooling connected to enterprise data.
• Familiarity with AI-specific security risks: prompt injection, tool-use abuse, data leakage through model context, and the controls that mitigate them.
• iPaaS or orchestration experience: Workato, Airflow, dbt, MuleSoft or similar.
• Detection engineering or SIEM exposure (Splunk, Panther, Datadog Security or similar).
• Snowflake or comparable cloud data warehouse operations, including cost and performance tuning.
• Background/experience supporting a GTM or revenue organization.
• Gong, HubSpot, Outreach or similar GTM tooling and their data models.
• Master data management, entity resolution, customer data platforms.
• Comfortable with pipeline, ARR and product-adoption metrics.

Responsibilities

• Define how we build and run internal software
• Set the standards for internal engineering at Front: how services are structured and deployed, how environments and secrets work, what gets logged, what "production-ready" means for an internal tool. Write them down, and make the documented path the easiest path.
• Partner with our product engineering org and inherit their tooling, patterns and processes wherever they apply to internal platforms. Front already runs production software well — the goal is to extend that foundation to internal systems, not to build a second one. Diverge where internal systems genuinely differ, and be able to say why.
• Define the reference architecture for internal systems and the security requirements every internal tool has to meet before it touches governed data.
• Own the review bar. Decide what needs review, what can ship freely, and be the person who says no when something isn't ready — with a clear reason and a path forward.
• Keep the standards honest as things change. Revisit them when they cause friction, retire the ones that stopped earning their keep, and don't let the documentation drift from what's actually running.
• Bring your own opinions and build consensus for them across GTM Systems, Data, Enterprise Security and Legal. You'll need those teams to adopt what you define, which means persuading rather than mandating.
• Own the infrastructure
• Own the cloud infrastructure our internal tools and AI systems run on AWS & Snowflake: compute, networking, data stores, DNS, certificates.
• Define infrastructure as code and get us to the point where nothing meaningful is provisioned by hand. Manage state, modules, and drift.
• Own environments — production, staging and whatever local story we give engineers — and make them consistent enough that "it worked in staging" means something.
• Run the observability stack: metrics, logs, traces and alerting that engineers can self-serve, and that tell you about a problem before a user does.
• Own platform cost. Right-size infrastructure and AI/warehouse consumption, attribute spend to the teams and tools driving it, and flag anomalies before they become finance conversations.
• Build the paved road
• Build and maintain CI/CD so GTM Engineers can ship without asking you: pipelines, test and scan gates, deploy and rollback.
• Provide golden paths — templates, base images, shared modules and libraries — so the standard way to build something is also the secure, observable, cost-sane way.
• Own secrets architecture: centralized storage, scoped short-lived credentials, and rotation that happens without a human remembering.
• Reduce toil through automation and self-service. Every request you make unnecessary is worth more than the one you fulfill.
• Secure the platform and the code that runs on it
• Own security of the infrastructure and SDLC for internal systems: IaC scanning, container and image hygiene, dependency and supply-chain scanning, secret detection, and CI/CD pipeline hardening.
• Harden cloud configuration against a defined baseline (CIS or equivalent), track drift, and remediate before someone else finds it.
• Run vulnerability management for platform infrastructure and internal application dependencies — scanning, triage, prioritization, patch coordination and verification against agreed SLAs.
• Be the security review on new infrastructure, integrations and AI tooling before they touch governed data, and keep an accurate inventory of what is connected to what.
• Design access and network boundaries so a compromised internal tool has a small blast radius. Enforce least privilege on the infrastructure layer.
• Respond when an incident touches your systems: containment, evidence preservation, and coordination with Enterprise Security, who own corporate detection and incident command.
• Own security monitoring/alerting across platform, integration layer and AI clients; build and tune detections for anomalous query patterns, unusual data egress, off-hours access, privilege escalation.
• Monitor audit logs from AI, Workato and the MCP layer and triaging signal from noise and build automations to trigger alerts.
• Define and implement Data loss prevention controls on paths where governed data leaves — including AI client responses and downstream exports.
• Compliance, incident response and RBAC
• Maintain and rehearse incident runbooks and tabletop exercises for named scenarios: leaked credentials, over-broad access grants, prompt-injection data disclosure, third-party integration compromise.
• Assist our GRC team with evidence collection for SOC 2, ISO, and any other relevant compliance frameworks.
• Scope reviews and access audits on a predictable cadence for MCP, Workato and AI client integrations.
• Respond to access requests and access incidents; removing standing access in favor of just-in-time.
• Partner with GTM Systems and Data teams to define access requirements for various data types across systems using RBAC, ABAC, or hybrid access control models.
• Partner with our internal IAM team to implement joiner-mover-leaver (JML) automations and leverage existing access governance tools for periodic access reviews.
• AI client layer
• Provide escalation support for troubleshooting MCP and tool integrations with our AI clients (Claude, ChatGPT, Notion, etc.).
• Maintain semantic layer configuration — tool definitions, schema descriptions, semantic views.
• Treat unauthorized exposure through an AI client as a security incident, not a bug.
• Root-causing data quality complaints.
• Keep it running, and keep engineers unblocked
• Operate the AI and data plumbing that internal tools consume — Workato recipes, MCP connectors, Snowflake access paths — and absorb upstream API and schema changes without downstream teams noticing.
• Serve as escalation point for platform problems, with clear triage, communication and resolution.
• Participate in on-call [TBD: confirm a rotation exists and who else is in it], and write postmortems with owned, dated follow-ups that you close out.
• Maintain runbooks and architecture documentation so the platform is operable and defensible by more than one person.
• Review other engineers' infrastructure and deployment changes, and raise the bar through that review.

Benefits

• Contractors have the option to work from our office on Tuesdays, Wednesdays, and Thursdays, when our teams are onsite. In-office attendance is optional and not required for this role.

What This Job Offers

• Career Level: Senior
• Education Level: No Education Listed