Senior Security Engineer, Infrastructure Security

ClickUp

1d•$160,000 - $210,000

About The Position

ClickUp is hiring a Senior Security Engineer for its Infrastructure Security team. The team protects the cloud, compute, network, and access layers supporting ClickUp, including its multi-account AWS organization, Kubernetes fleet, infrastructure as code, and the identity systems engineers use to access production. The team uses AI agents it builds and maintains to extend its security coverage. The role combines infrastructure security engineering, architecture reviews, agentic tooling, incident investigation, identity and access management, and continuous security monitoring. The engineer will review and author security designs, communicate security guidance to technical and non-technical partners, develop and maintain agents and their sandboxed infrastructure, lead cloud and infrastructure alerts and incidents through root-cause resolution, and create secure building blocks that engineering teams can adopt by default. The position also hardens compute, network, and CI/CD systems and advances continuous reviews that produce evidence for infrastructure controls.

Requirements

At least 5 years of experience in security engineering, cloud infrastructure, or SRE, including at least 2 years securing AWS at organization scale.
At least 1 year of agentic development experience, including building agent skills and tools for engineering work and developing and maintaining their development harness, including configuration, permissions, integrations, evaluations, and cost controls.
Ability to secure agents against prompt injection, over-privileged tools, and unaudited actions, and explain the confused deputy problem and the lethal trifecta.
Deep AWS IAM experience, including IAM Identity Center or an equivalent SSO model, SCPs, permission boundaries, resource and key policies, cross-account trust, and proving policy effects through simulation.
Production Kubernetes security experience on EKS or similar, covering RBAC, workload identity, network policy, admission control, and container runtime hardening.
AWS networking security experience, including VPC design, endpoints and endpoint policies, network and DNS firewalls, egress control, and WAF.
Fluency with infrastructure as code such as Terraform, including reusable patterns, multi-environment rollouts, and assessing security impact from plans.
Experience with CNAPP, SIEM, or runtime security tooling and related cloud detection sources such as CloudTrail, GuardDuty, and Access Analyzer.
Experience investigating cloud and infrastructure security events by correlating cloud audit, Kubernetes, identity, and network logs to establish events, blast radius, and root cause.
Track record of reviewing architecture and writing design proposals, guiding teams toward secure designs through conversation, mentoring through reviews, and turning reviews into changes teams can adopt.
Proficiency in Python, Go, or TypeScript for security automation.
Clear written and verbal communication, including explaining technical risk to non-technical partners; ability to produce well-evidenced findings, proposals, or design notes that teams can act on asynchronously.

Nice To Haves

Experience using AI agents in a SOC or other incident response workflows.
Sandboxed runtime experience with gVisor, Firecracker, or Kata.
Offensive security or red-team experience in cloud and Kubernetes environments.
Experience with policy engines such as OPA or Rego.
Experience supporting audits such as SOC 2 with automated evidence collection.

Responsibilities

Review infrastructure proposals and designs from engineering and non-engineering teams, write security proposals, and review resulting changes.
Translate security requirements and agent findings into clear guidance for less-technical partners, and incorporate partners’ needs into security designs.
Build, evaluate, and maintain agents used for reviews, triage, and investigations, and help operate the sandboxed, observable infrastructure on which they run.
Lead cloud and infrastructure alerts and incidents through resolution and root-cause analysis, collaborating with AppSec and incident response on cross-functional incidents.
Advance least-privilege and just-in-time access for people, CI, and services across the cloud organization and production-access tooling.
Deliver secure building blocks that teams can adopt by default.
Harden container, serverless, and virtual machine workloads, the network perimeter, and CI/CD pipelines.
Add automated checks to catch recurring classes of security issues.
Move vulnerability, access, and attack-surface reviews toward continuous monitoring that also produces evidence for infrastructure controls.
Validate agent output against evidence and determine where human review is required.