Sr Infrastructure & Security Engineer

Vizypay•Waukee, IA

1d•Onsite

About The Position

This position is in-office, located in Waukee, Iowa. Vizonian Life VizyPay is leading the technology-payment processing space. Our culture is built on trust, transparency, technology, and talent. We are the voice for business owners, putting money back in their pockets and eliminating up to 100% of their processing fees. It’s time to love what you do and be your authentic self! Yes, we hold each other accountable. If you’re successful, we’re all successful - this is why we #workhardplayhard so #LFG #TeamVizy! The Gig The Sr. Infrastructure & Security Engineer owns the cloud infrastructure, enterprise network, security posture, operational reliability, and end-user support functions that keep VizyPay connected, protected, and audit-ready. Reporting directly to the CIO, the role unifies cloud and platform engineering, networking, site reliability engineering, security engineering, and IT support into a single senior individual-contributor mandate spanning the infrastructure foundation beneath VEXIS — VizyPay's proprietary CRM platform — and the organization's business systems. The role is a core contributor to the annual PCI DSS assessment and the enterprise BCP/DR programs. Operating cloud-first in a security- and compliance-driven payments environment, it is accountable for availability and resilience (RTO/RPO), detection and response readiness, measurable risk reduction, infrastructure cost, and audit-ready controls in production.

Requirements

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent, required.
7+ years of professional experience across infrastructure, cloud, network, security, or site reliability engineering, including 4+ years operating production infrastructure and security controls at scale with accountability for availability, cost, risk, and outcomes.
Demonstrated ability to operate with a high degree of autonomy — owning infrastructure and security strategy, priorities, and execution while reporting directly to executive leadership.
Experience in security- or compliance-constrained environments (e.g., PCI DSS or financial services regulation), including direct participation in compliance assessments and audit evidence collection, delivering under formal SDLC and change management.
Demonstrated incident-response ownership across infrastructure and security domains: on-call participation, incident command or mitigation leadership, and postmortem-driven improvement.
Proven ability to translate infrastructure, security, and reliability tradeoffs into clear recommendations for technical and executive stakeholders.
Expertise in Cloud platforms: production engineering on Microsoft Azure, AWS, or DigitalOcean — compute, virtual networking, IAM, storage, and managed database services.
Familiar with infrastructure automation: Terraform (or equivalent), GitOps workflows, configuration management, and CI/CD engineering (e.g., GitHub Actions, Azure DevOps) with security scanning and progressive delivery; Python, PowerShell, and/or Bash operational tooling with strong Git fluency.
Expertise in containers, orchestration, and serverless: Docker and Kubernetes (e.g., AKS, EKS, DigitalOcean Kubernetes) or managed container services; serverless/edge compute (e.g., AWS Lambda, Cloudflare Workers).
Understanding of operating systems and directory services: Windows Server and Linux administration, Active Directory/Microsoft Entra hybrid identity, and Microsoft 365 administration.
Skilled in network infrastructure: enterprise firewalls, SD-WAN, switching, and wireless — design, administration, and troubleshooting, with strong routing/switching fundamentals (VLANs, routing protocols, QoS) and VPN.
Knowledge in network and cloud security: segmentation design, firewall policy management, DNS, TLS certificate management, WAF/CDN (e.g., Cloudflare), encryption at rest and in transit, and cloud security posture management (CSPM).
Experience with security monitoring, detection, and vulnerability management: enterprise SIEM/log analytics, EDR, and FIM platforms — detection content development, alert tuning, response integration — plus enterprise scanning, risk-based prioritization, and remediation workflow design.
Knowledge with identity, endpoint, and end-user platforms: least-privilege RBAC, MFA-inclusive authentication, identity lifecycle and privileged access management (PAM), directory and identity platforms (e.g., Microsoft Entra ID, AWS IAM), endpoint security, MDM, password management platforms, and vault-based secrets management.
Demonstrate ability in reliability engineering: SLO/error-budget practice, observability tooling, database backup/recovery, replication, and point-in-time restore (e.g., PostgreSQL, SQL Server, MySQL).
Track record of technical leadership: mentoring, architecture or design review, or engineering standards ownership.

Nice To Haves

Preferred cloud and automation certifications: AWS Solutions Architect – Professional or DevOps Engineer – Professional, Azure Solutions Architect Expert (AZ-305), Azure Administrator (AZ-104), CKA, or HashiCorp Terraform Associate.
Preferred security and identity certifications: ISC2 CISSP or CCSP, CSA CCSK, Microsoft AZ-500, SC-300, SC-100, or MD-102, AWS Security – Specialty, CKS, or CompTIA Security+/CySA+.
Preferred networking, incident-response, and compliance certifications: Microsoft AZ-700 or SC-200, AWS Advanced Networking – Specialty, CompTIA Network+, GIAC (e.g., GSEC, GCIH, GCIA, GMON), ISACA CISA or CRISC, PCI Professional (PCIP), or Cloudflare platform accreditations where applicable.
Experience in payments, fintech, banking, or another regulated financial domain; hands-on PCI DSS assessment participation across multiple annual cycles.
SRE practice depth (SLO/error-budget programs, chaos or resilience testing); FinOps/cloud cost-management practices; multi-account/landing-zone architecture.
Zero-trust or SASE architecture; detection engineering depth (e.g., MITRE ATT&CK); securing or supporting AI/ML workloads (OWASP LLM Top 10) aligned with VizyPay's enterprise AI roadmap.

Responsibilities

Architect, build, and operate secure, scalable cloud infrastructure across Microsoft Azure, AWS, and DigitalOcean — compute, virtual networking, storage, and managed data services — supporting VEXIS and enterprise systems.
Expand infrastructure-as-code (e.g., Terraform) and GitOps automation as the default provisioning path, including policy-as-code and IaC security scanning; build CI/CD pipelines (e.g., GitHub Actions, Azure DevOps) with automated testing and controlled promotion; eliminate manual, unrepeatable changes.
Manage infrastructure cost and capacity: rightsizing, reserved-capacity strategy, usage monitoring, and performance optimization, with spend reported against approved budget and capacity kept ahead of business growth.
Provide technical leadership across InfraSec and in partnership with Software Engineering: engineering standards, design and architecture reviews, and mentorship as a hands-on individual contributor.
Administer and support the enterprise network — firewalls, SD-WAN, switches, wireless access points, and overall network infrastructure — including design, configuration, monitoring, and lifecycle management.
Own network segmentation design and enforcement, TLS 1.2+ everywhere, and secure connectivity — site-to-site and remote-access VPN, DNS, load balancing, and WAF/CDN (e.g., Cloudflare) — aligned with least privilege.
Maintain network documentation, configuration baselines, and audit-ready change records; manage network capacity, performance, and availability.
Own and manage key security platforms and services — identity and access management (IAM), endpoint security, mobile device management (MDM), password management, security monitoring, and Microsoft 365 security posture, including email security controls (e.g., anti-phishing, DMARC/DKIM/SPF) — including administration, policy, integration, and continuous improvement.
Own security monitoring and detection engineering across enterprise SIEM, EDR, and file integrity monitoring (FIM) platforms: log-source onboarding, detection content, alert tuning, and response runbooks.
Operate the vulnerability management program (coverage, risk-based prioritization, remediation SLAs), patch management cadence for operating systems and endpoints, and asset/configuration inventory; own identity lifecycle management (joiner/mover/leaver), conditional-access policy administration, and privileged access management (PAM); enforce vault-based secrets management and MFA-inclusive authentication; lead threat modeling and security-by-design with Software Engineering and Product.
Define and operate SLOs, error budgets, and availability/performance monitoring; own the observability stack end to end — metrics, structured logging, distributed tracing, and alert design (e.g., Prometheus/Grafana, CloudWatch, Azure Monitor) — with centralized log management and retention aligned with compliance requirements; drive toil reduction through automation-first operations.
Own incident response across infrastructure and security: detection, escalation, mitigation, and blameless postmortems with tracked corrective actions; participate in the on-call rotation; operate all production changes under formal change management.
Serve as the Tier 2/3 escalation point for end-user support in partnership with the InfraSec Help Desk: endpoint engineering and lifecycle management, Microsoft 365 administration and troubleshooting across devices and business systems, and automation of support workflows with measured service quality.
Participate in the annual PCI DSS assessment and audit process — evidence collection, remediation activities, control validation, and collaboration with internal stakeholders and external assessors — coordinate external penetration testing and remediation tracking, and maintain audit-ready evidence year-round: configuration standards, access reviews, segmentation validation, monitoring coverage, and recovery-test results.
Design and validate resilience — RTO/RPO alignment, backup and recovery, failover architecture, and graceful degradation — and plan and execute disaster-recovery exercises consistent with enterprise BCP/DR standards.
Contribute to security policy, standards, risk assessments, and employee security-awareness enablement in partnership with the CIO; align all controls with PCI DSS and financial-industry obligations.